245: Startup Fraud – What to Do When an Employee Is Stealing From You

Steli Efti:

Hey everybody, this is Steli Efti …

Hiten Shah:

And this is Hiten Shah, and today on the Startup Chat, we’re going to talk  about startup fraud. So Steli, I know you have a story. What’s up?

Steli Efti:

Yeah. So, specifically, we’re going to talk about what happens if somebody in your startup,  somebody that you hired that works with you, is doing some shady shit. Is doing  things that they’re not supposed to do and stealing money from you or your customers,  or just lying in one way or another. I’d love to hear your thoughts and  what to do to prevent this. How to notice it. What to do when you  notice it. But I have a story that really sparked this. The way that we’ve  built close.io is different in one very specific way to many other CRM’s in which  that we have a huge amount of transparency with our system. So anybody within an  organization that uses Close.io can see transparently all communication that happens with a prospect or  customer. All email communications, all calls, call recordings, everything is in one place. So quite  frequently, we’ll get a customer that tells us that they found a sales rep that  did something that they weren’t supposed to do, and the only way and reason why  they noticed it is because of this level of transparency. And recently, we got one  of the most shocking examples of this. So, a Close.io customer on a startup that  goes through textiles right now in New York City, they had hired a sales rep, and that sales rep’s job was to schedule demo calls for the founder. And the  idea was to call marketing agencies and set up calls with the head of marketing  there or something. So the founder noticed a bunch of weird stuff, and eventually he  looked a little bit deeper and he could see the timeline communication between that sales  rep and the prospect, that the prospect would be whatever Bob at this big agency  company. But the email communication would be some random Bob email at Hotmail or at  Yahoo mail or something. Not the real agency corporate email. And then when he would  start to listen to these calls, these calls sounded really weird. In a sense he  got the suspicion that this sales rep was actually talking to himself on these calls,  like calling a fake number, and then using a voice distorter to talk to himself  and pretend this is a prospecting call to set up a demo. So he started  to listen to a number of different call recordings and the prospect always sounded the  same. Then he noticed that when he … Some of these demos that the sales  rep had set up for him, when he would talk to that quote-unquote Bob from  marketing agency X, the person would sound super young, and would be totally unknowledgeable about  agencies and marketing, and would sound nothing like the person of the recordings that the  sales rep had, pretend to be Bob. So, a lot of weird stuff, and he  was collecting more and more evidence, and eventually he came to the conclusion that this  rep was faking activity, was faking calls, and faking demo schedules, and then would have  friends of his pretend to be these people to do these demo calls with the founder because he was paid on a per-demo scheduled basis, which is pretty wild. He  confronted the sales rep, and it turned out that was accurate, and it kind of  blew his mind. Thankfully, it sucks to have to go through something like this where  you wasted a ton of time doing demos that were fake and paying somebody that wasn’t deserved to be paid money and wasting time training and coaching somebody and all  that. The only good news here is that I think he picked this up pretty  quickly, so this was not going on for months, but just for a few weeks.  Obviously, it still sucks when this happens. I don’t know, I’m just curious to hear  if you have some stories like this. How to prevent these things from happening. Just  chit-chatting with you a little about it, because I have some other stories as well  to share with some thoughts. But I’d love to hear your reaction on this specific  case. Have you ever heard something as crazy as this? With a voice distorter and  all this shit? Yo Hiten, you still there? I don’t hear you.

Hiten Shah:

Yeah, I’m here. It’s super difficult in a startup to, on one hand, you trust  the people you hire, on the other hand, you want to make sure they’re not  doing anything like this. And you might not even think about it when you hire them, because you hired them, and you have some level of trust because you hired  them. So to me, yeah, I’ve heard lots of weird stuff, this one is pretty  extreme, I would say. It’s funky. In my opinion, your company, your startup, if you’re  a founder, CEO even, it’s your brand. It’s such a big deal to you. It’s  an important aspect of your identity. I’m not saying it is your identity, although we  could argue about that or have a podcast on that. I know you agree with  me on whatever I’m thinking on that. We’ve talked about this a little bit, startups  are not your baby, because they aren’t our babies. So I would say that the  line that comes in my head is trust, but verify. So when you hire someone  to do a core process early-on in your business, you want to make sure that  you can trust them. And you don’t know them most of the time. So if  you don’t know them, you already know you can’t trust them, they’re not like your  best friend, or they’re not highly recommended. Even if they are highly recommended, sometimes they  do weird stuff. You create systems early on, so you can start verifying as you trust them. So in this case, calls should have been recorded, and you might have  sat-in on those calls initially. Really understood what the person was sending. The only reason  is on one hand, some people might think I’m crazy and say “Oh, but you’re  micro-managing”. Well, actually, I just want to learn. I want to make sure that this is an area I don’t have visibility on, and someone new is starting. I don’t  know how it works. Or I’ve been doing it, I want to make sure it’s  done a certain way. Why wouldn’t I want to look at it? Why wouldn’t I  want to hop-in on the calls and understand what’s going on? Then over time, you  can build that trust. I think a lot of the relationship of someone joining your  company and yourself, and the whole company as a whole, is a process of building trust. That comes in different aspects depending on the role.

Steli Efti:

I totally agree. So I love the trust but verify, right? Because this is exactly  what I had in mind when I heard this story. The way that I would  go about this is I would really think about this in the beginning, you might  want to check-in more frequently, right? The first four weeks that somebody joined your company  is now reaching out, especially if it’s a customer-facing role. You might want to be  a bit more active in the verifying part. It’s not just to verify, it’s also  to just get feedback, to get context, to really understand what’s going on. If you  train somebody to schedule demo calls, I would want to be on some of these  calls that this rep has to schedule demo calls to just listen to how the  conversation goes. Listen to what’s going on. Get feedback. Learn. But the way that you  do it, you do it frequent in the beginning, and less and less frequent over  time. So, if in the first week, I might want to join four calls. The  second week, maybe two. The third, one. Then I might be just joining one call  a month, and then eventually one call a quarter. Maybe just one call a year.  So it’s not about micro-managing somebody forever because that’s not scalable and not feasible. It’s  also not a great experience for the person that’s doing the job. Once I heard  a few of your calls, I don’t need to be in every single call. I  get the idea of what you’re doing. But not joining any of your calls from  Day 1 is just pain stupid, right? It’s also not … Even if the fraud  thing is not even in question, it’s not the greatest onboard experience, because no matter  how much you talk about these calls with your new employee, your new team member.  Listening to them while it’s happening is going to give you so much more context  on giving valuable feedback and helping them do their job better. So trust by verify  is a big one. Here’s one that even happened before trust and verifying. Obviously for  me, the best way to avoid having somebody that frauds you or your customers in  your team is to prevent it from happening in the first place by not hiring  that type of person, right? So having a really good hiring process … Oh, one  thing that we … We got frauded, and I’ve talked about this in a prior  episode. We’ve never had an issue with a sales team, or success team, support team,  or any of that in many many years, because I think we’re doing a really  good of vetting people. But the only time somebody lied to us, and we had  hired him, and we found out two weeks later, he was actually a designer. We  had hired this designer many years ago, four or five years ago. That person had sent in a great record of good companies he had worked for. He sent in  some really good work, and we were excited. We had him fly into San Francisco,  and worked with him during a day. But working with him meant he was on  his laptop, and then he was showing us things, and we were really impressed. Then  when we hired him, all of a sudden things changed. He would tell us he  would upload the Version 1 design. So first of all, he wanted much longer times  to show work, and we pressured him to be more iterative and more collaborative. Then  he was like, “I’m going to upload this on Friday, the first version”. Friday would  come. Monday would come, and he would be like “Oh, I uploaded it, I’ll try  again tomorrow”. Tuesday would pass. Wednesday would pass. He’d be like, “Well, it’s uploaded on  my thing”. Eventually we were just like, “Can you just screen-share what you have, and  we’ll just take pictures since we can’t find it in dropbox?” And he’d be like,  all of a sudden, he’s sick. Within two weeks, we realized something funky is going  on. And then when he showed us what he had, it was totally different in  quality than the stuff he was showing us during the interviewing process. We realized, after  doing some research, that the stuff that he showed us during the interview process was  not his. Actually, he took a bunch of really good design templates that were out  there and just edited them slightly to fit what we wanted him to work on,  but he hadn’t done any of these original designs. So he basically lied to us  the entire time. We let him go really quickly, but it was a painful experience.  That taught us to be better at background checks. So we would never hire anybody  anymore without talking to two, three, four employers, without even asking for direct reference. We’ll  ask you for direct references, but we’ll find indirect references and ask about the quality  of work. We would have found out things about him if we had done it  that way. That would be my tip. Prevent that from happening by doing a bit  more homework before you hire somebody. Because usually when people do fraudulent shit, they have  a track record or history of doing that, so you’ll catch them. Once you hire  them, you want to trust them, but at the earliest, you want to verify and  then go less and less frequent. I agree with that as well. Now, what happens  … There’s different ways of, let’s call it the Shady-shit Bucket, right? So there is  the crass example, which is just pure fraud. Somebody is faking calls or faking signatures,  using fake credit cards, or just plain-out lying and stealing money from either the customers  or you, right? So the most criminal even, the most crass activity possible. That’s one  bucket, but there’s many shades of this, so this is pure fraud. But there’s something  in between as well where somebody might just be lying but not in as crass  of a way. Maybe they’re telling you they’ve done something and they haven’t yet, and  you discover that afterwards. Or maybe, one case that’s popular in sales, again where Close  has been really useful to our customers to detecting this, is inflating the numbers a  little bit. So some reps will show that they’ve made a hundred calls a day,  but then when a founder looks at these calls, the founder realizes that many of  the calls had a duration of one second. So it’s clear that the rep would  dial a number and hang up, and the system would count the calls as a  hundred dials. But you could also see that the minutes on the phone were drastically  too low, and kind of pick up on that versus in some other software or  other some other scenario, you just wouldn’t know. You would just see that a rep reported a hundred calls, but you don’t know that they’re not real calls. Once you  figure any of these scenarios out, what’s the plan to actually moving forward? What do  you do? You find that one person in your company has done something like this.  What do you do next?

Hiten Shah:

I think the first thing I would like do to in those scenarios, and I  do do, is I seek to understand. I’d go to them and be like, “I  noticed X, Y, and Z. Just curious what your thought process was around doing X,  Y, and Z”. Then from there, it gets pretty obvious. There might be a good  reason, usually there isn’t. Really, for me, that conversation is literally about letting them go,  firing them, whatever extreme you want to use. That being said. There is a five percent chance, let’s say maybe lower, that there’s nothing wrong. But it’s very low. I  always approach it like they didn’t do anything wrong, and I just want to understand.  Even though, I’m 99% sure. I know what I need to do, and I’m prepared.  That being said, I think it’s unfair to look at a situation, look at these  things, and not understand why someone did them. I’m fair to you, not even them.  It’s just unfair situation to make this judgment call. Even if it’s awful, without understanding  someone’s own thought process. One of the reasons is that they’re human, you’re human. None  of us are aliens here, none of us are robots. Let’s talk through it and  really understand each other. I think that their response is what impacts my decision more  than anything else. It’s more of my decision on how I approach letting them go,  because it’s unlikely that if they’re doing something that grossly negligent, or weird, or fraudulent,  or whatever extreme or level of this it is, it’s not cool. If you don’t understand how they did it, you’re not going to understand how to prevent it in  the future from other people either. That’s my take on it. And how to get  better at hiring and whatnot.

Steli Efti:

I love when we are in disagreement, right? These episodes are fun, and I have  to think about a topic. We haven’t disagreed strongly in a while, but this is  a topic where it’s also just fun to hear you say exactly what I would  want to say. So even using the words that I would use is word-for-word. I’m  asking you the question, I’m thinking something, and you say it exactly the same.

Hiten Shah:

That’s great.

Steli Efti:

I love it. So we’re very aligned in many things as well, that’s no secret.  But I would collect a lot, I would do my homework. Don’t instantly react once  you see just one little thing that’s weird, right? Don’t be emotional. Collect, do some  research, do some homework. Then sit down and talk to them. I would do it  exactly the way you suggested. Don’t tell them “I saw these ten things, why are  you stealing money?” Don’t make any claims, don’t make any accusations. Just say, “Hey, recently,  I noticed something that I couldn’t quite understand or explain. I did a little bit  more research. Here’s the four things that I found. Can you explain this to me?”.  Right? Just allow them to tell you what’s going on. Because you’re right, once in  a while you might be wrong, and they might have a really good explanation, and  then you’re going to be very happy you didn’t scream at them or you didn’t  tell them they’re liars and stealing. They’ll be like, “Oh shit, well that explains everything.  Now how could we make sure that there’s more context in our data so it  doesn’t look funky anymore?” But if they can’t explain themselves, or if they explain themselves  in a way or excuse their behavior in a way that you don’t buy and  believe. I will ask you again, what do you do? Do you believe in second  chances? Let’s say somebody goes, “You know, I’m really sorry. Yes, I had a lot  of pressure” or whatever. “My uncle was sick”. “I didn’t have gas in my car”.  “It was raining”. Whatever they have as explanations. “So I did something that’s out of  character, I’ve never done something like this before. I will never do it again. I’m  super sorry.” What do you do with that? Because if somebody just lies to you  and acts like an asshole, it might be very easy to say that you’ll just  let them go. But I’m curious, do you believe in second chances with somebody, that  maybe even you buy into the idea that this is not typical behavior, would you  give them another chance or no?

Hiten Shah:

Nine times out of ten, no. It just nine times out of ten. You don’t  have time for a second chance in a startup, usually. We’re talking about startups. If  it’s a larger business, there’s very specific ways to handle this. If you’re an enterprise,  corporate, whatever you want to call it, or even past 50 or 100 team members,  there’s very specific ways to handle this if it is not culturally correct, you know?  There’s a whole extreme conversation on this that I don’t think we’ve had around companies  like Zenefits and all the fraud that came out of there. Or if you want  to go to a different kind of extreme, Uber, and the culture, that being the  norm. I think that’s a little different. Outside of that though, I don’t know. It’s  not that people don’t deserve a second chance or I don’t believe in any of  that, some things are just so extreme and not culturally aligned that it doesn’t work.  That’s why I started by saying the company is your brand, as a founder, CEO,  whatever, executive. Even every team member, there’s a brand aspect to it. If you are  okay with the person doing that, then yeah, it’s cool. There’s no even second chance  opportunity because that’s a norm. If you’re not okay with it and it’s not culturally  a good fit, and they were willy-nilly doing it, it’s very rare that they’re going  to change. It’s very rare that a second chance is going to change anything. So  nine times out of ten, I’m not going in thinking they get a second chance.  That being said, if there’s something I don’t understand about the situation, I’m open.

Steli Efti:

I absolutely agree with you. I think that I do believe in second chances, but  that doesn’t mean that I need to give you a second chance, at this startup,  at this time. There’s just so much baggage, so much work and friction. When somebody  has done something like this once, you will never ever fully trust them again, I  think. It’s very hard, not never, but it’s very hard to fully trust them. Even  if they behave perfectly for a few months, it’s going to stick in the back  of your mind that maybe in another day where it’s rainy or they feel pressured  or something, they’re going to go back to doing things that are going to be  bad for you, or your brand, or your company, or your customers. So, along that,  a doubt that I will have to second-guess this person is too much, and I  think it’s not going to be good for them and me. If somebody does something  that’s clearly absolutely wrong-lined to our customers lying to us, I don’t believe in second  chances. I believe that you need to, with dignity, let them go and let them  learn from their experience and do it better somewhere else, and start with a clean  slate. But not at my company. Alright, so I think that’s it from us on  this topic. This is a funky topic, but I thought it would be fun to  talk about.

Hiten Shah:

Oh, I love it. Yeah, it’s great. I think it’ll be useful. It’s something that  I haven’t really thought about in a while.

Steli Efti:

Alright, this is it from us, people. We’ll talk soon.

Hiten Shah:

Later.