Finding the Phantom in Vendors

Posted on: September 1, 2023
Author: Hisham Kassim

Phantom Vendors

“I don’t think all of the company’s expenses are legitimate,” Sam said over the phone.

“How do you know?” I asked. “I just know,” Sam said.

I sighed, “Okay, let me see what we can do.” As I hung up the phone, I thought to myself, “I just know” isn’t going to be enough for the investment committee. The problem was that I believed Sam.

Sam was an investment director at a venture fund. Our firm was helping Sam conduct due diligence on a company we will call TriStar.

TriStar had a typical corporate structure for the Middle East – its main operating company was registered in Saudi Arabia and its holding company was registered in the Cayman Islands. TriStar was a late-stage technology company and had just closed their Series A round. They were now looking to raise a small bridge round from a few investors, including Sam’s fund. TriStar had been in business for five years, had fifty employees, and more than a hundred vendors. All in all, there were about 10,000 expense transactions for us to go through.

Sam and I could not audit all of these transactions over the next few days even if we had an army of people helping us.

Sam’s hunch was that TriStar’s founder was skimming money by paying phantom vendors. Phantom vendors are shell companies set up by people close to the company to drain funds away from the company by charging the company for various overpriced “services” and “goods” (services are more common since goods are easier to count and track). Phantom vendors almost never provide any real
value to the company.

Now Sam and I had to figure out how we were going to know which of the hundred or so vendors were phantom vendors. We could eliminate about twenty vendors off the top since they were well known (e.g. Google, Amazon, etc.) but that still left us with eighty vendors or so to go through.

If time and money were not an issue, we could have audited each of the eighty vendors and determined which were the phantom vendors. It would have been a time consuming exercise – calling each vendor, analyzing their receipts and invoices, and verifying that they actually did provide TriStar with whatever goods or services they claimed they did.

However, as is common in venture investing – we had very limited time and a very limited budget.

Benford’s Law

Simon Newcomb was born in 1835 in Wallace, Nova Scotia. He had little formal schooling but worked as a mathematician and astronomer with the U.S. Navy and at Johns Hopkins University. Newcomb discovered that the first pages of logarithm textbooks (which are like complicated multiplication tables) were much more worn by readers thumbing through them than later pages.

Simon Newcomb (1835-1909)

This observation gave him the idea that in any data set (or group of numbers), numbers that start with low digits like “1” or “2” are much more common (e.g. they have a higher rate of occurrence) than numbers that start with higher digits, like “8” or “9.”

This finding was later tested and formalized countless times by other mathematicians over the following hundred years. The general rule or formula, is now known as Benford’s Law. Frank Benford was also born in the 19th century and worked as a mathematician. He is largely credited with testing and popularizing Newcomb’s initial findings.

Benford’s Law says that in any data set, numbers that start with lower digits appear more frequently than numbers that begin with higher digits.

In any given data set, numbers that start with “1” should appear about 30% of the time; numbers that start “2” should appear about 17% of the time; and numbers that start with “3” should appear about 12% of the time.

The larger the initial number the less likely it is to appear in any given data set. The number “9” should only appear first about 5% of the time.

This pattern can be found in almost every type of social or natural phenomena whether it is the height of buildings (in any unit of measurement), credit card transactions, the length of rivers, and even in our case, if we believed that phantom vendors were issuing invoices to TriStar to drain money away from the company.

TriStar’s Receipts

The job now was to take all the receipts and invoices issued by those eighty vendors and separate them into nine categories. Receipts that were for $124.35 were put into “1” the pile, those that were for $256.08 were put into the “2” pile until all the receipts were categorized according to the number that they started with. Once the receipts were categorized, we just had to count the number of receipts in each pile.

The main discrepancy we found was that there were twice as many receipts that started with the number “8” as there should have been. Receipts that started with the number “8” should account for only 5% of all the receipts but TriStar had almost double the number of receipts that started with the number “8” (10%). This told us that those receipts (the ones that started with the number “8”) were more likely to have been issued by a phantom vendor than a legitimate one.


The above is a fictionalized scenario intended to illustrate how Benford’s Law can be applied to real life circumstances. While Benford’s Law has been in existence for well over a hundred years it is not widely known or used outside a very small circle of forensic and fraud examiners. The actual calculations used when testing data sets using Benford’s Law are much more complex than as presented here.

Download the PDF of the Article here


This article is provided for informational purposes only and should not be construed or seen as legal or tax advice of any kind. You should consult a legal, tax, and/or other professional before you rely on any of the information contained above.