Stolen From Within: 806 Checks, Seven Years, $1.2 Million — And Nobody Was Looking

Stolen From Within: 806 Checks, Seven Years, $1.2 Million — And Nobody Was Looking

This is Episode 2 of Stolen From Within, a four-episode October series on Your Profitable Law Firm dedicated to real, verified cases of financial fraud inside law firms. All cases are sourced from DOJ press releases, state bar disciplinary records, or federal court filings. Every named individual was convicted or pled guilty.

This series was inspired by a conversation with Delisi Friday, whose work in the legal operations space pushed a passing intention into a month-long commitment. Thank you, Delisi.

The question every law firm owner should be able to answer: if the person managing your money decided to steal from you, how long would it take you to find out?

The case in this episode suggests that for many firms, the honest answer is years.

The Case: Jairo Tomas Santos

The law firm is a San Francisco, California firm where Santos worked as the office manager.

Jairo Tomas Santos had been with the firm for approximately 22 years. He was trusted. He had access to the check stock, the bank accounts, and the accounting system. And according to federal prosecutors, he spent seven of those years — from no later than March 2016 through February 2023 — writing 806 unauthorized checks to himself, forging the senior partner's signature on every one, and depositing the checks into his personal bank accounts.

Then he manipulated the firm's general ledger to make sure no one noticed.

Every fact in this post comes from DOJ press releases issued by the U.S. Attorney's Office for the Northern District of California: August 8, 2023; November 20, 2023; and March 14, 2024. Santos pleaded guilty on November 20, 2023. He was sentenced on March 14, 2024.

How the Scheme Worked

Starting no later than March 2016 and continuing through February 2023, Santos obtained blank checks from the firm's Wells Fargo operating account. He filled in the payee line with his own name, forged the signature of the firm's senior partner, and deposited the checks into his personal bank accounts.

806 times.

That's roughly 10 checks per month, every month, for seven years. At an average of about $14,000 per month flowing out of the firm.

But Santos didn't just steal the money. He also deleted and altered entries in the firm's general ledger to conceal the payments. He was manipulating both sides — the bank account and the books — at the same time.

He continued depositing unauthorized checks for at least eight months after his employment ended in June 2022.

Santos was indicted by a federal grand jury on July 25, 2023. He pleaded guilty on November 20, 2023. U.S. District Judge William H. Alsup sentenced him to 36 months in federal prison on March 14, 2024, and ordered him to pay full restitution of nearly $1.2 million. In his sentencing remarks, the judge called Santos' conduct "unforgivable."

Why No One Caught It: The Separation of Duties Problem

The reason this went undetected for seven years comes down to one thing: one person controlled the entire transaction cycle with no independent oversight.

Santos had access to the physical checks. He could write them and complete the payee line. He also had access to the accounting system, where he could make and delete entries. Nobody else was reviewing what he was doing on either side.

This is called a separation of duties failure. The idea is simple: the person who handles money should not be the same person who records what happened to the money — and neither of them should be the person who checks that the two match.

Think of it like a lemonade stand. If one kid pours the lemonade, takes the money, keeps the tally, and counts the jar at the end of the day with no one else watching, there's no way to catch it if he pockets a few dollars. He just erases the tally marks. The jar matches the sheet. Nobody knows.

That's exactly what Santos did. He was running the whole stand with no one else checking the count.

In a law firm, full separation of duties means three distinct roles:

1. The person who can move money — write checks, send payments

2. The person who records transactions in the accounting system

3. The person who reviews — compares the actual bank statement to the books

In a small firm, role three is often the law firm owner. You don't need to do the bookkeeping. You just need to be the one who looks at it.

Internal Controls: Locks and Cameras

Separation of duties is one part of a larger concept called internal controls — the rules and routines a business sets up so that mistakes and theft either can't happen, or get caught quickly when they do.

There are two kinds:

Preventative controls stop a problem before it happens. Think of them as the lock on your front door.

Detective controls catch a problem after it happens, ideally fast, while the damage is still small. Think of them as the security camera.

You need both. A lock can be defeated. A camera that nobody ever watches doesn't help anyone.

Preventative Controls You Can Put in Place Now

Lock up the check stock.

Blank checks are essentially blank cash. They should be physically secured, and the person with access to them should not be the same person recording transactions in the books.

Require dual approval on checks.

Any check or payment over a set dollar threshold needs a second signature. That second signature should be the law firm owner. If the only person who can sign a check is a partner — and that partner actually sees every check — 806 forged signatures don't happen.

Never allow signature stamps.

No signature stamps, no "just sign it for me, I'm in court." If it can be signed without the partner seeing it, the control is gone.

Use positive pay.

Positive pay is a bank service where your firm submits a list of the checks it actually wrote. When a check comes in that isn't on your list, the bank flags it and asks before paying it. A check made out to the office manager that isn't in your check register gets caught on the very first attempt — not at number 806.

Limit system permissions.

Not everyone needs the ability to delete transactions in your accounting software. Lock that function down to as few people as possible.

Revoke access the day someone leaves.

Keys, passwords, bank logins, accounting system access, check stock. Same day — not next week. Santos continued depositing unauthorized checks for eight months after his employment ended because his access wasn't fully cut off.

Detective Controls You Can Put in Place Now

Review the actual bank statement every month.

Log into your bank directly — not a report your bookkeeper generated, not a printout from your accounting software. Look at what actually cleared. Pull up the check images. Do you recognize every payee name?

Many banks offer view-only access so you can do this without the ability to move money. If you're too busy to do this yourself, a paralegal or administrator who does NOT have check-writing or bookkeeping access can do it instead.

Have someone independent do the bank reconciliation.

Someone who doesn't write the checks should compare the bank records to the firm's records and explain every difference. This is the grown-up version of mom counting the lemonade jar.

Do your three-way trust reconciliation every month.

The 806 Santos checks came out of the operating account, not the IOLTA account — but the trust account has its own risk. Every month, compare the bank statement, the trust ledger, and the individual client ledgers. All three should agree.

Review the audit trail.

Most accounting systems keep a log of every entry that was made, changed, or deleted. Santos deleted entries to cover his tracks. A monthly review of deleted and edited transactions takes only a few minutes and functions like reviewing security camera footage.

Watch the payee list.

A new payee that looks like an employee's name or uses an employee's address is worth a question. Don't just approve it.

The Fraud Triangle — And What You Can Actually Control

Fraud experts describe three things that are typically present when someone steals from an employer: pressure (they need or want money), rationalization (they've told themselves a story about why it's okay), and opportunity (they believe they can do it without getting caught).

You can't control what's happening in your employees' personal lives. You can't control the stories they tell themselves.

But you can control the opportunity. And that's exactly what internal controls do.

Controls work in three ways. First, they make stealing harder — if two people are required to move money, one person can't do it alone. Second, they make getting caught more likely and faster — fraud that goes undetected for seven years is only possible when nobody's looking; when someone's looking every month, the problem becomes a one-month problem instead of a seven-year one. Third, and this one is underestimated: controls change behavior just by existing. When your team knows the partner reviews the bank statement every single month, the person who's tempted does the math and decides it isn't worth it.

There's one more thing worth saying: good internal controls protect your honest employees, too. When something goes wrong — and eventually something always will, even by accident — controls are how you show who didn't do it.

Four Red Flags in the Santos Case

Looking back at the Santos case, four control failures stand out. Any one of them, addressed, could have changed the outcome.

No independent review of bank statements.

If a partner or outside accountant had been reviewing the actual Wells Fargo statements monthly, the unauthorized checks payable to Santos would have been visible. Santos manipulated the general ledger, but he couldn't touch the bank's records.

One person controlled both check stock and general ledger access.

Santos had access to the physical checks, the ability to complete the payee line, and the ability to make and delete entries in the books. No second set of eyes existed anywhere in that cycle.

No reconciliation between the check register and cleared items.

A check register reconciliation compares the checks the firm believed it issued against what actually cleared the bank. If someone had been doing this monthly, checks payable to Santos personally would have appeared as unreconciled items immediately.

Access was not revoked at termination.

Santos' employment ended around June 2022. He kept depositing unauthorized checks for at least eight months after that. His physical access to the office was apparently not fully cut off on the day he left.

Three Things That Would Have Changed This Story

This case involved seven years, 806 checks, and $1.2 million. And it took all three of the following missing controls to let it happen:

1. A partner or outside accountant reviewing the actual bank statements — not bookkeeping reports — every single month

2. Separation of duties between the person who handled the check stock and the person who recorded the transactions

3. A formal off-boarding process that revoked all financial system access on the last day of employment

Any one of those three things would have significantly changed this story.

Stolen From Within — The Full October Series

This is episode two of four. Each episode this month covers a real, verified case of fraud inside a law firm, sourced entirely from DOJ press releases, state bar records, and federal court filings.

Episode 1 (Oct 7): She Worked There for Six Years. She Stole $839,000. Nobody Noticed.

Episode 2 (Oct 14): He Signed the Partner's Name 806 Times.

Episode 3 (Oct 21): They All Had Access to the Trust Account. That Was the Problem.

Episode 4 (Oct 28): The Checks Were Right There. Nobody Was Looking.

Subscribe so you do not miss any of them.

Frequently Asked Questions

What is the easiest way to prevent check fraud at a law firm?

The single most accessible starting point is reviewing the actual bank statement yourself every month — not a report generated by your bookkeeper, but the statement directly from the financial institution, with check images. This one habit would have caught the Santos fraud early.

What is positive pay and does my bank offer it?

Positive pay is a fraud prevention service offered by most business banks. Your firm submits a list of checks it issued; the bank compares incoming checks against that list and flags any that don't match before paying them. Contact your bank's business banking team to ask about enrollment.

How do I set up separation of duties at a small law firm?

You don't need three full-time employees. In a small firm, the law firm owner typically serves as the reviewer — the person who looks at the bank statement, asks questions about the reconciliation, and verifies that what the books say matches what the bank shows. The bookkeeper records transactions. Someone else (or the owner) reviews. That split is enough.

Can I give a paralegal or administrator access to review bank statements without giving them the ability to move money?

Yes. Most banks offer view-only access for business accounts. This allows a trusted staff member to review cleared items and check images without being able to initiate transfers or payments.

What should I do when an employee with financial access leaves the firm?

Revoke all access on the last day of employment — bank accounts, accounting software, payroll systems, check stock storage access, and any physical keys. Do not wait until the end of the week or until a replacement is trained. Santos demonstrated why this matters: he kept stealing for eight months after his termination.

What is the fraud triangle?

The fraud triangle describes three conditions that are typically present when an employee commits fraud: pressure (financial or personal stress), rationalization (a mental justification), and opportunity (the ability to steal without getting caught). Employers cannot control pressure or rationalization, but they can dramatically reduce opportunity through internal controls.

Related Reading on Your Profitable Law Firm

If this episode connected with where your firm is right now, these posts go deeper on related topics:

- How Attorneys Can Build a Book of Business Without Feeling Like a Salesperson

- AI Won’t Fix Your Law Firm… But This Will

- Profit Psychology: Why Law Firm Owners Self-Sabotage Financially

This case is drawn from public DOJ press releases issued by the U.S. Attorney's Office for the Northern District of California on August 8, 2023, November 20, 2023, and March 14, 2024.