Thread by @smdiehl

Let's discuss the nature of 'control fraud' in the corporate world, and how businesses which are legitimate in their individual components can be fraudulent in their overarching structure. 🧵

So say you're an executive at a company (maybe like a bank or a crypto company), and you want to commit some activity that is legally prohibited and/or fraudulent. But you also want to protect yourself against liability from that action.

The absolute best way to do this is not to create a line of business for the fraud, personally profit, and then cover it up; but instead create a sufficiently criminogenic corporate environment in which others do the fraud for you "without" your knowledge while you profit.

You do this by setting up an environment in which said fraud isn't done directly through directives by supervisors and explicit company policy, but through legitimate actions like hiring, firing, and setting up incentive structures to support the fraud implicitly.

There are *so many* examples of this in financial services, it's almost become the go-to fraud for that entire sector.

The best example here in the UK is the PPI misselling scandal that ran from early 1990s to mid 2000s.

PPI is a form of short-term income protection insurance, that brokers would offer to customers that took out mortgages and that would make your mortgage payments in the event that you fell ill or lost your job.

However there's an open market for these policies that offered competitive prices, however many high street banks got into the practice of silently bundling these ridiculously overpriced and useless policies with new mortgages without the consent of the customer.

This raked in billions of pounds for the banks executives, on insurance policies that were over-priced, useless and simply extracted wealth from the public for nothing. The executives paid themselves lavish bonuses and ran off with the cash.

Now explicitly this is form of fraud known as 'misselling' and in principle it was banned by the policy at the banks. As official policy low-level bank employees weren't supposed to do this.

However, if you happen to bind employee compensation and bonuses to the number of PPI policies you personally sell, then the incentive structure of the position itself silently encourages you to commit fraud.

Employees that didn't participate in misseling were silently pushed out because they didn't meet their sales quotas, while the employees engaging in fraud were given bonuses. All while their managers remain ignorant and not liable for anything other than just doing their job.

Because of leaks from whistleblowers to the press, the story came to light and there were many lawsuits to recover damages. There was a similar scandal in the United States with Wells Fargo opening up accounts with consent.

The public is rightly angry at these situation, but really who is to blame legally?

1) The minimal wage low-level employees?
2) The middle managers who didn't make the policy?
3) The executives for not being involved in the day to day?

The answer is really everyone and no one. No single person is responsible, blame is spread out across the whole organisation and it's the whole ensemble that allowed it to happen.

If you understand this, you understand the nature of modern corporate fraud and why it's so easy to get away with. Our system really can't find a party to blame, because blame is diffuse across the entire organization. And in legal sense the executives hands are completely clean.

The principle of our justice system is that it's better that ten guilty persons escape than that one innocent suffer.

While for corporate justice, it's better that ten thousand scams go unpunished than one innocent enterprise endure a lawsuit.

The golden era of distributed control fraud is coming.

As technology is more integrated into the workplace, increasingly these scams aren't going to be done through policy but by tech and networks that spread blame even more diffusely across the organisation and third parties.

The next hundred corporate scandals will have executives covering up new forms of control fraud with the excuse that {AI, influencers, blockchain} created the incentives for the scam, not me.

How we adapt to that is a defining problem for a new generation of business leaders.