What happened in the UltraColor dummy-invoice fraud?

According to ABC News Investigations, a long-serving personal assistant and accounts clerk at UltraColor, an aerosol-paint manufacturer, stole about A$3.7 million over roughly 17 years by creating dummy supplier invoices and directing the money into her own accounts. She lost most of it on poker machines — ABC determined at least A$2.8 million went through St Marys Rugby League Club, and about A$240,000 through Windsor RSL. She was sentenced in February 2021 to four and a half years in prison.

How would a forensic audit have caught it?

Fake-supplier (ghost-vendor) fraud is one of the most detectable patterns there is once you actually look. Matching every supplier payment against a verified vendor, a real delivery, and a bank account that isn't linked to an employee surfaces invented suppliers quickly. A silent forensic reconciliation of the bank records against the accounting system — exactly what our AI audit tools do — would have flagged the dummy invoices and the money's true destination in days, not 17 years.

Did the business get its money back?

Largely not. According to the ABC, St Marys Rugby League Club — which held more than A$85 million in net assets — declined to return the funds, saying it had no knowledge of the criminal conduct and citing the Proceeds of Crime Act. It is a recurring feature of these cases: the gambling venue keeps the money, and the victim business wears the loss. Finding the fraud early is usually the only money that comes back.

$3.7 Million into the Pokies Over 17 Years: The UltraColor Dummy-Invoice Fraud

Q: How was it discovered?

By confession, not by control. The clerk admitted the theft to her employer about 15 minutes before he was due to meet international businessmen interested in buying the company. For 17 years the fake-supplier scheme had run undetected — right up until she chose to reveal it.

For seventeen years, a trusted accounts clerk at a small Australian manufacturer invented suppliers that didn't exist, paid their "invoices" into her own accounts, and fed the money — A$3.7 million of it — into poker machines. No audit caught it. No control caught it. It ended only when she confessed, about fifteen minutes before her boss was due to meet the people who wanted to buy his company. This case is a masterclass in how long fake-supplier fraud can run when nobody is quietly checking.

What happened

According to ABC News Investigations, a long-serving personal assistant and accounts clerk at UltraColor, an aerosol-paint manufacturer, stole around A$3.7 million over roughly 17 years — the theft began within about two years of her being hired in 1999 and was discovered in September 2018. Almost all of it went through poker machines: the ABC's analysis found at least A$2.8 million was lost at St Marys Rugby League Club, with a further ~A$240,000 at Windsor RSL over five years. She was sentenced in February 2021 to four and a half years in prison.

The fake-supplier method

Her method is one of the most common in insider fraud, and one of the most preventable: she created dummy bills for suppliers and directed the payments into her own accounts. On the books, every one of those payments looked like an ordinary expense to an ordinary vendor. Nothing stood out — because nobody was checking that the vendors were real, that goods were actually delivered, or that the bank accounts receiving the money didn't belong to a staff member.

That's the quiet danger of ghost-vendor fraud. A single fake supplier, paid steadily over years, blends perfectly into accounts payable. It is invisible on the ledger and obvious the moment someone matches the payments against reality.

Seventeen years, then a confession

What finally stopped it wasn't a control — it was the clerk herself. She confessed to her employer about fifteen minutes before he was scheduled to meet international businessmen interested in buying the company. For seventeen years before that moment, the scheme had simply worked. Had she not spoken up when she did, there is no obvious mechanism that would have surfaced it.

Why the money didn't come back

Here's the part that stings for every business owner. According to the ABC, St Marys Rugby League Club — which held more than A$85 million in net assets — declined to return the funds, saying it had no knowledge of the criminal conduct and pointing to the Proceeds of Crime Act. It is a recurring feature of gambling-driven theft in Australia: the money pours into a venue, the venue keeps it, and the victim business is left to wear the loss. Which means the only reliable way to limit the damage is to find the fraud early — the money that's already gone usually stays gone.

How a silent audit catches this

This is exactly why we run silent, discreet forensic audits with our own electronic AI audit tools — quietly, from the data, so nobody is tipped off while the truth comes out. Ghost-vendor fraud is one of the clearest patterns those tools find:

Match every supplier payment to a real supplier. Payments to vendors with no ABN, no delivery, no history — or to bank accounts linked to an employee — surface immediately.
Reconcile the bank against the books. The actual money leaving the company, matched against what the accounting system says it was for, exposes the invented expenses.
Do it continuously and discreetly. A seventeen-year fraud is a seventeen-year failure to look. Our AI audit tools look at the whole money flow — every account, up to seven years — remotely, with nobody on the floor any the wiser.

The lesson of this case, like the borrowed-login bookkeeper case and the $19m CommBank fraud, is that trust is not a control, and annual audits miss what they aren't built to find. If you want to know — quietly, and for certain — whether your books match your bank, our forensic accounting audit is built for exactly that.

Sources

Facts and figures are as reported by ABC News Investigations (2021).

ABC News — "Over $3.7 million stolen from this small business and put into the pokies, but clubs can keep the money", 7 April 2021: abc.net.au.

$3.7 million into the pokies, over 17 years