5 ms·

No, they did ask. And got Bank statements. They even went to a subsidiary branch of the bank and confirmed that the money exits in Indonesia (or was it the Phil

No, they did ask. And got Bank statements. They even went to a subsidiary branch of the bank and confirmed that the money exits in Indonesia (or was it the Philippines?). The problem: This bank had no branch in Singapore (or wherever it was). He set up a fake branch with actors that showed EY computer statements - EY took pictures of the screens - with the balance. You can't make this up. EY screwed up, but they could not have reasonably assumed that someone sets up a fake bank branch.

KingOfCoders 3y ago
Yes I know they did ask. As the responsible manager for IT (usually CTO - internal SOX was a different matter) I have been "asked" by EY (and KPMG) about IT setups and security several times for audits. And I could have told them whatever I like, the people were right out of university with no clue about the matter and in no position to ask the right questions except reading their checklist; I always had the impression they only knew half the words they were reading.
- 19h 3y ago
  Did you remove Wirecard from your LinkedIn?
  - alsetmusic 3y ago
    > Did you remove Wirecard from your LinkedIn? [Not the person you replied to.] Did the person you replied to work for LinkedIn? What's the context for this question?
    - 19h 3y ago
      I was just curious and visited the LinkedIn profile that's linked to from the ctone.ws website (in KingOfCoders's profile) and was wondering why Wirecard was omitted.
      - bitcharmer 3y ago
        Why on earth would you assume the OP was affiliated with Wirecard?
        renewiltord 3y ago
        I believe the term is “hallucinations”. LLMs have fewer of them than many humans.
        deleted 3y ago
        [deleted]
        19h 3y ago
        > As the responsible manager for IT (usually CTO - internal SOX was a different matter) I have been "asked" I misread this as "reponsible manager for IT [at Wirecard]", hence the question.
      - stolsvik 3y ago
        This is so embarrassing to read.
  - Sebguer 3y ago
    Are you thinking their post is indicating that they were part of the Wirecard audits? They're saying they've undergone similar audits.
  - Beijinger 3y ago
    No, since I did not work for Wirecard. But my resume is so bad, I wish I had Wirecard on it.
- consp 3y ago
  KPMG asked me once: "Can you show it's actually encrypted?" Do you have any programming skills? ... No? Then no. Then they started blabbing about what the data could be and it basically came down on them not understanding what random is and they then just checked it off and went on. Since then I do not believe any audit which come from those paper farms.
  - wolfi1 3y ago
    I once saw the acronym translated as "Keiner prüft mehr genau" (No one does checking accurately any more)
    - summarity 3y ago
      Also “Kinder prüfen meine Gesellschaft”
      - kreck 3y ago
        And „Kommen, prüfen, meckern, gehen“
        lukan 3y ago
        Translation service: “Kinder prüfen meine Gesellschaft” children check my company „Kommen, prüfen, meckern, gehen“ come, check, complain, go KPMG seems to have quite a reputation.
    - namibj 3y ago
      Double-meaning: s/mehr genau/genauer/ Though that reading is a bit weird, it's practical enough to tickle the funny.
  - Aloisius 3y ago
    > Can you show it's actually encrypted? When someone asks a question like this, they're not literally asking you to show them it. They just want an expert to confirm it they could show it, so they can check off their box for due diligence. Congratulations. You were the expert.
- namdnay 3y ago
  I think the role of an auditor is to make sure all the right questions have been asked and record who answered and what they answered. Asking them to be guarantors of truth is maybe putting a bit too much faith in a non-judicial investigation
  - lukan 3y ago
    "Asking them to be guarantors of truth is maybe putting a bit too much faith in a non-judicial investigation" But them knowing what they are checking, is maybe a reasonable ask?
    - JoBrad 3y ago
      That almost seems like they would need to be active in the relevant field they are auditing. I’m not sure if the auditor role pays enough to hire people from all of the various fields that have to be audited.
      - jstarfish 3y ago
        They'd also have to be trained in fraud investigations and counter-espionage considering who they're up against. It's not the purpose of an auditor.
        lukan 3y ago
        "It's not the purpose of an auditor." Well, what is the purpose of an auditor then in this context? Genuine question. Not my world. I know code auditors - and they have to know about programming and the domain to provide any meaningful audit.
        imperfect_blue 3y ago
        Audit is not a foolproof guarantee that no fraud exists, the same way that locking your door doesn't guarantee that no crime exists. It deters opportunists by making crime more difficult and onerous. In this context, they're just making sure the answer isn't "no, it's not encrypted". Sure, you can lie, and that would fool them. But your answer will be cross-checked with other employees, maybe with other documentation if those exists. And sure, you can forge all of those as well, as Marsalek did with his bank statements. But these sort of verification significantly raises the bar to how difficult it is to commit fraud: you now need to get several people into the conspiracy to forge those documents and audit trail. Your average employee isn't willing to lie for their company for no good reason and risk prosecution, and may very well whistle-blow on you.
someguydave 3y ago
It was the Philippines. Wirecard hired a Philippine lawyer Tolentino (who was also a government minister) to make up a fake trust that held the fake money https://newsinfo.inquirer.net/1441886/ex-dotr-exec-others-face-raps-in-wirecard-scam https://newsinfo.inquirer.net/1441886/ex-dotr-exec-others-fa... “The NBI said Arellano, an employee at the BPI branch in Malate, Manila, had admitted to receiving P10 million for issuing bogus bank certification documents that Tolentino and his law office needed as the supposed local trustee of Wirecard.” I guess it goes to show that if you are dealing with enough cash to bribe third world governments then all kinds of new fraud schemes become possible.
- dmix 3y ago
  > if you are dealing with enough cash to bribe third world governments We shouldn't discount the connections a GRU agent would have in 3rd world govs, they know who is corrupt enough (or able to be coerced) to do their bidding. Fake banks accounts is pretty old stuff in the spying world. It's not just money.
- baybal2 3y ago
  [dead]
hinkley 3y ago
Couldn't they, though? A billion dollars can buy a lot of grift. But I guess bean counters aren't the demographic for heist or confidence movies so maybe the Hollywood ending didn't occur to them.

KingOfCoders 3y ago

Yes I know they did ask. As the responsible manager for IT (usually CTO - internal SOX was a different matter) I have been "asked" by EY (and KPMG) about IT setups and security several times for audits. And I could have told them whatever I like, the people were right out of university with no clue about the matter and in no position to ask the right questions except reading their checklist; I always had the impression they only knew half the words they were reading.

19h 3y ago
Did you remove Wirecard from your LinkedIn?
- alsetmusic 3y ago
  > Did you remove Wirecard from your LinkedIn? [Not the person you replied to.] Did the person you replied to work for LinkedIn? What's the context for this question?
  - 19h 3y ago
    I was just curious and visited the LinkedIn profile that's linked to from the ctone.ws website (in KingOfCoders's profile) and was wondering why Wirecard was omitted.
    - bitcharmer 3y ago
      Why on earth would you assume the OP was affiliated with Wirecard?
      - renewiltord 3y ago
        I believe the term is “hallucinations”. LLMs have fewer of them than many humans.
        deleted 3y ago
        [deleted]
      - 19h 3y ago
        > As the responsible manager for IT (usually CTO - internal SOX was a different matter) I have been "asked" I misread this as "reponsible manager for IT [at Wirecard]", hence the question.
    - stolsvik 3y ago
      This is so embarrassing to read.
- Sebguer 3y ago
  Are you thinking their post is indicating that they were part of the Wirecard audits? They're saying they've undergone similar audits.
- Beijinger 3y ago
  No, since I did not work for Wirecard. But my resume is so bad, I wish I had Wirecard on it.
consp 3y ago
KPMG asked me once: "Can you show it's actually encrypted?" Do you have any programming skills? ... No? Then no. Then they started blabbing about what the data could be and it basically came down on them not understanding what random is and they then just checked it off and went on. Since then I do not believe any audit which come from those paper farms.
- wolfi1 3y ago
  I once saw the acronym translated as "Keiner prüft mehr genau" (No one does checking accurately any more)
  - summarity 3y ago
    Also “Kinder prüfen meine Gesellschaft”
    - kreck 3y ago
      And „Kommen, prüfen, meckern, gehen“
      - lukan 3y ago
        Translation service: “Kinder prüfen meine Gesellschaft” children check my company „Kommen, prüfen, meckern, gehen“ come, check, complain, go KPMG seems to have quite a reputation.
  - namibj 3y ago
    Double-meaning: s/mehr genau/genauer/ Though that reading is a bit weird, it's practical enough to tickle the funny.
- Aloisius 3y ago
  > Can you show it's actually encrypted? When someone asks a question like this, they're not literally asking you to show them it. They just want an expert to confirm it they could show it, so they can check off their box for due diligence. Congratulations. You were the expert.
namdnay 3y ago
I think the role of an auditor is to make sure all the right questions have been asked and record who answered and what they answered. Asking them to be guarantors of truth is maybe putting a bit too much faith in a non-judicial investigation
- lukan 3y ago
  "Asking them to be guarantors of truth is maybe putting a bit too much faith in a non-judicial investigation" But them knowing what they are checking, is maybe a reasonable ask?
  - JoBrad 3y ago
    That almost seems like they would need to be active in the relevant field they are auditing. I’m not sure if the auditor role pays enough to hire people from all of the various fields that have to be audited.
    - jstarfish 3y ago
      They'd also have to be trained in fraud investigations and counter-espionage considering who they're up against. It's not the purpose of an auditor.
      - lukan 3y ago
        "It's not the purpose of an auditor." Well, what is the purpose of an auditor then in this context? Genuine question. Not my world. I know code auditors - and they have to know about programming and the domain to provide any meaningful audit.
        imperfect_blue 3y ago
        Audit is not a foolproof guarantee that no fraud exists, the same way that locking your door doesn't guarantee that no crime exists. It deters opportunists by making crime more difficult and onerous. In this context, they're just making sure the answer isn't "no, it's not encrypted". Sure, you can lie, and that would fool them. But your answer will be cross-checked with other employees, maybe with other documentation if those exists. And sure, you can forge all of those as well, as Marsalek did with his bank statements. But these sort of verification significantly raises the bar to how difficult it is to commit fraud: you now need to get several people into the conspiracy to forge those documents and audit trail. Your average employee isn't willing to lie for their company for no good reason and risk prosecution, and may very well whistle-blow on you.

someguydave 3y ago

It was the Philippines. Wirecard hired a Philippine lawyer Tolentino (who was also a government minister) to make up a fake trust that held the fake money https://newsinfo.inquirer.net/1441886/ex-dotr-exec-others-face-raps-in-wirecard-scam https://newsinfo.inquirer.net/1441886/ex-dotr-exec-others-fa... “The NBI said Arellano, an employee at the BPI branch in Malate, Manila, had admitted to receiving P10 million for issuing bogus bank certification documents that Tolentino and his law office needed as the supposed local trustee of Wirecard.” I guess it goes to show that if you are dealing with enough cash to bribe third world governments then all kinds of new fraud schemes become possible.

dmix 3y ago
> if you are dealing with enough cash to bribe third world governments We shouldn't discount the connections a GRU agent would have in 3rd world govs, they know who is corrupt enough (or able to be coerced) to do their bidding. Fake banks accounts is pretty old stuff in the spying world. It's not just money.
baybal2 3y ago
[dead]

hinkley 3y ago

Couldn't they, though? A billion dollars can buy a lot of grift. But I guess bean counters aren't the demographic for heist or confidence movies so maybe the Hollywood ending didn't occur to them.