Stolen From Within: She Worked There for Six Years. She Stole $839,000. Nobody Noticed.

Stolen From Within: She Worked There for Six Years. She Stole $839,000. Nobody Noticed.

This series was inspired by a conversation with Delisi Friday, whose work in the legal operations space pushed a passing intention into a month-long commitment. Thank you, Delisi.

The question every law firm owner should be able to answer: if the person managing your money decided to steal from you, how long would it take you to find out?

The case in this episode suggests that for many firms, the honest answer is years.

The Case: Reese Esther Paul

The law firm is the Law Office of Rovner, Allen, Rovner, Zimmerman, Sigman and Schmidt, a Pennsylvania firm with New Jersey operations.

The bookkeeper is Reese Esther Paul, 66 years old at sentencing. She worked at this firm for six years, from December 2017 through December 2023. Over that period, she stole $839,816.41.

Every fact in this post comes from the Bucks County District Attorney's Office press release dated June 27, 2025. This case was fully adjudicated. Paul pled guilty and was sentenced on June 26, 2025.

How the Scheme Worked: Two Phases Over Six Years

Phase One: 71 Unauthorized Checks

From December 2017 through approximately 2021, Paul wrote 71 unauthorized checks to herself totaling $372,816.41. Each check was signed with the forged signature of Robert Rovner, the firm's senior partner. Rovner was over 60 at the time. He passed away in 2021.

At least one of those checks was flagged in 2020 for suspected forgery of the senior partner's signature. The fraud continued for three more years after that flag appeared.

Phase Two: 90 Electronic Transfers Disguised as Filing Fees

After the senior partner died, the method changed. From December 2021 through December 2023, Paul made 90 unauthorized electronic transfers totaling $450,000 to her personal credit card accounts.

She disguised those transfers in expense reports as payments to the New Jersey Judiciary Account Charge System — the system attorneys use to pay court filing fees. A routine expense. Something nobody would question.

That is not a random choice. That is someone who understood this firm's financial environment well enough to hide inside it.

How It Was Discovered

The scheme came to light when a check from the firm's New Jersey escrow account bounced.

Not an audit. Not a suspicious partner. Not an alert from the bank.

A bounced check — after six years, 71 unauthorized checks, 90 electronic transfers, and $839,000.

The absence of routine financial controls meant there was no mechanism to catch the problem. The only thing that surfaced it was running out of money.

What She Did With the Money

According to court records, Paul spent the stolen funds on personal and family expenditures including travel, retail purchases, cash advances, online gambling, and contributions to her grandchildren's college savings accounts.

At sentencing in June 2025, she had provided $100,000 in restitution. The chief deputy district attorney noted she had not taken significant steps to liquidate assets toward the full amount. $839,816.41 was ordered in restitution.

The Sentence

Paul pled guilty in March 2025 to dealing in proceeds of unlawful activities, theft by deception, identity theft, access device fraud, computer trespass, and forgery.

She was sentenced by President Judge Raymond F. McHugh to one year less a day to two years less a day in the Bucks County Correctional Facility, followed by five years of probation.

The Red Flags That Should Have Caught This

Every fraud case has warning signs that, in hindsight, were visible. Here is what they were in this case.

One person controlled both checks and expense reporting

Paul had access to the firm's checkbook and was the person creating the expense reports. The person who writes checks should not be the same person who categorizes and records them. When one person controls both sides of a transaction, there is no internal check.

Bank statements were not being reviewed independently

If someone independent of Paul had been reviewing the actual bank statements monthly — not reports generated from the accounting system, but the actual statements from the financial institution — the unauthorized checks would have appeared. Electronic transfers to personal credit card accounts would have appeared.

A 2020 flag was not investigated thoroughly

At least one check was flagged for suspected forgery in 2020. The fraud ran for three more years. Whatever investigation occurred did not surface what was actually happening. When a flag appears, it requires a complete investigation — not a resolution and a move on.

Remote work without added controls

Paul worked remotely from Pennsylvania while the firm had New Jersey operations. Remote arrangements are not inherently risky, but they require more oversight than in-office arrangements, not less.

No verification of expense reports against source documents

The New Jersey Judiciary Account Charge System generates records. If someone had periodically matched expense report line items against actual court system invoices, the discrepancy between what Paul reported and what the court system actually charged would have been visible.

Three Controls That Would Have Caught This in Year One

This scheme did not require sophisticated detection. It required basic controls that most law firms do not have in place.

Control one: Someone other than the bookkeeper reviews the actual bank statements every month. Not a QuickBooks report. The statements from the bank. This catches unauthorized checks and transfers that may have been deleted from the accounting system.

Control two: Separation of duties between the person who processes transactions and the person who records them. One person should not control both the check stock and the expense reporting.

Control three: Complete follow-through when any flag appears. A suspected forgery in 2020 was a signal. Following that signal to its source would have ended this scheme four years earlier.

These are not expensive controls. They do not require new software. They require a deliberate decision to verify the work of the people you trust.

Trust But Verify

This case is not remarkable because the theft was large. It is remarkable because it was preventable.

The firm was not incompetent. The attorneys were not careless. They were busy practicing law and trusting the person they had hired to manage their finances.

That trust is not the problem. The problem is the absence of verification.

Trust without verification is not a financial control. It is an opportunity. And Reese Esther Paul used it for six years.

Stolen From Within — The Full October Series

This is episode one of four. Each episode this month covers a real, verified case of fraud inside a law firm, sourced entirely from DOJ press releases, state bar records, and federal court filings.

• Episode 1 (Oct 7): She Worked There for Six Years. She Stole $839,000. Nobody Noticed.

• Episode 2 (Oct 14): He Signed the Partner's Name 806 Times.

• Episode 3 (Oct 21): They All Had Access to the Trust Account. That Was the Problem.

• Episode 4 (Oct 28): The Checks Were Right There. Nobody Was Looking.

Subscribe so you do not miss any of them.

Frequently Asked Questions

How do law firm bookkeepers steal money without being caught?

The most common method is exploiting the absence of independent bank statement review. When the bookkeeper is the only person who sees the bank statements and reconciles the accounts, they can write unauthorized checks or initiate transfers to themselves and manipulate the accounting records to hide the transactions. Without someone outside of the bookkeeping function reviewing the original bank statements monthly, the fraud can run indefinitely until the money runs out or an accident reveals it.

What financial controls prevent bookkeeper fraud in a law firm?

Three controls catch the majority of bookkeeper fraud. First, someone independent of the bookkeeper — a partner, a managing attorney, or an outside accountant — reviews the actual bank statements from the financial institution every month. Second, duties are separated so the person who processes transactions is not the same person who records them. Third, any suspicious transaction or flagged item is investigated completely rather than noted and set aside.

What is separation of duties and why does it matter for law firms?

Separation of duties means that no single person controls all steps of a financial transaction. The person who writes checks should not also record those checks in the accounting system. The person who approves expenses should not also pay them. When one person controls the entire cycle of a transaction, there is no point at which a second set of eyes enters the process, which is precisely what fraud schemes depend on.

What should a law firm owner do when a suspicious transaction is flagged?

Investigate it completely before moving on. In this case, a check was flagged for suspected forgery in 2020. The fraud continued for three more years. Whatever investigation occurred was not sufficient to surface the full scheme. When something looks wrong, the investigation should run until there is a definitive explanation, not until the surface-level issue appears to be resolved.

How often should a law firm review its bank statements?

Monthly, and the review should be conducted by someone independent of the person who manages the day-to-day bookkeeping. The reviewer should be looking at the actual statements from the financial institution, not reports generated from the accounting software, because accounting system records can be altered by someone with access to the system. Bank statements from the financial institution cannot.

Related Reading on Your Profitable Law Firm

If this episode connected with where your firm is right now, these posts go deeper on related topics:

• Why Your Law Firm Needs CFO-Level Thinking, Not Just a Bookkeeper

• A CFO Reviews a Real Law Firm P&L — Here Is What She Found

• Jason Henneberry Explains Why Growth Makes Your Law Firm Feel Heavier