A shell company is a business that exists on paper and nowhere else. No employees, no product, no real address beyond a rented mailbox. On its own that is not illegal, and plenty of legitimate holding companies are shells. The trouble starts when someone inside your company sets one up, points your accounts payable at it, and starts sending invoices for work that was never done.
How one of these schemes runs
The version we see most often runs through accounts payable, because that is where one trusted employee can both create a vendor and approve its bills. Picture a mid-level manager with authority over vendor setup and invoice approval. He registers a few companies with vague names and vaguer services, maintenance work or packaging supplies, the kind of line items nobody questions on a large project. He rents a mailbox for each and starts billing his own employer.
The invoices get approved and paid because the person approving them is the person who set the vendor up. Nobody confirms the company is real. Kept below the amount that would trigger a second review, the payments do not stand out. A scheme like that can move several million dollars in under a year before something breaks it, and what usually breaks it is a whistleblower rather than a control. By then the money is gone, and the company is left with the loss, the legal bill, and some hard questions about how it went unnoticed.
Verify a vendor before you pay it
The gap that lets this work is a weak new-vendor process. A company that will pay an invoice without ever confirming the vendor exists is exposed. A basic check closes most of that door. Confirm the business is really at the address it gave. Look for any genuine online presence. Make a test call and send a test email. Ask for references and actually follow up on them. None of this is hard, but it has to be written down and taught, not left to whoever happens to be setting up the vendor that day.
Make people put their relationships on paper
An annual conflict-of-interest form asks every employee to disclose the family, personal, business, and financial ties they have that touch the company. On its face it looks toothless. A fraudster is obviously not going to list the shell company he secretly controls. The value is indirect. When disclosure is a standard, documented step, it tells employees the company checks these things, and that shift in the environment deters people who would otherwise assume nobody is paying attention.
Test the vendor file itself
Most shell schemes leave fingerprints in the master vendor file, and regular testing finds them. Search for vendors whose address or bank account matches an employee's. Watch for dormant vendors that suddenly show activity or changed details. Flag separate vendors that share information and are really one hand wearing two gloves. Pull invoice numbers that run in sequence or start suspiciously low, which suggest you are that vendor's only customer. Sort for payments that sit just under an approval threshold. A vendor that only ever bills $4,800 against a $5,000 limit is telling you something.
None of these flags proves fraud on its own. A real vendor can share a zip code with an employee or bill in round numbers. What they do is point you at the handful of records worth a closer look, and that is the whole game. Shell company fraud lives on nobody checking. The fix is to check, on a schedule, in a way the person running the scheme cannot predict.
Seeing red flags like these in your own numbers?
A confidential consultation costs nothing and tells you where you stand.
What it means for your matter
Most engagements are not Enron. But the pattern is the same at every scale: a diverted vendor payment, a related party that shouldn't exist, revenue booked before it was earned, a reserve fund that never quite reconciles. The methods used to expose a multibillion-dollar fraud are the same methods that expose a bookkeeper skimming from a small business or a managing agent taking kickbacks from a co-op.
If something in your financial picture doesn't add up, the earlier a forensic accountant looks, the more of the trail survives. Documents get lost, memories fade, and money moves. The record is easiest to reconstruct while it is still fresh.
Think something's wrong with your numbers?
Talk to a forensic accountant. It's confidential, and there's no obligation.