WALL STREET PROMPTResearch
felipesinisterra.com

The Anatomy of a Cooked Book

Felipe Sinisterra · felipesinisterra.com

A backtested catalog of accounting-fraud tells across two decades of US-listed frauds — what actually predicted the blow-up, what only looked like it did, and how early each signal fired.

Fraud sample358 AAER · 770 non-reliance · 43 short-vindicated
Backtest327 matched fraud firm-years vs 1308 controls
Universe56,332 as-filed firm-years, 2009–2025
MethodAs-filed EDGAR · point-in-time · BH-corrected

Key takeaways

  1. No single tell is a smoking gun. The strongest individual signal — Prior non-reliance (8-K 4.02) in trailing 24m — fires in only 11.2% of frauds. 7 of 26 tested indicators survive multiple-testing correction, but the best odds ratio is ~3.3x. Fraud detection is a weight-of-evidence problem, not a single-flag problem.
  2. Governance and disclosure events beat the ratio screens. The highest-odds tells are behavioral and disclosure-based — a prior restatement, a late filing, an auditor change, officer exits — not the classic accrual ratios. Beneish and Dechow scores add value at the margin, but the loudest signals are things management does, not just what the numbers say.
  3. The simple flag-count beats the fitted model out of sample. A transparent count of firing flags separates fraud from control at AUC 0.66 on a held-out 2016–2025 test set, while an L1-penalized logistic on the same features collapses to AUC 0.55. Fraud regimes shift; an over-fit model chases the last war. Count the flags.
  4. Precision is the binding constraint for a short seller. Screening the top decile of the composite across the whole universe yields ~3.4% precision against a ~2.6% base rate — only ~1.3x lift. The tells narrow a 4,000-name universe to a few hundred; they do not hand you the name. Forensic confirmation is the rest of the job.
  5. A high score predicts labeled fraud, not generic corporate death. Top-decile-flagged names were no more likely to delist or go bankrupt within 24 months than low-score names (15.5% vs 13.8%). Broad corporate mortality is dominated by benign mergers and going-private, which track size, not fraud. The composite's edge is fraud precision, not a delisting oracle.
  6. Short sellers and journalists catch fraud; auditors and the SEC arrive late. Across the forensic case set, market-facing detectors (activist shorts, anonymous researchers, journalists) were the first to surface the fraud in 56% of cases; auditors and the SEC combined for 19%. If you are waiting for the enforcement action, you are the exit liquidity.
  7. The tells fire early — often a year or more before the reveal. Median lead times: prior non-reliance ~20 months, auditor change ~18 months, late filing ~21 months, officer exit ~40 months. The signal is on the tape while the stock is still working.

Methodology

We assembled every US-listed accounting-fraud case we could label from public records over 2005–2025, computed a battery of quantitative and event-based indicators from as-originally-filed EDGAR data (never restated comparatives), and measured how each discriminated fraud firm-years from matched controls — strictly using information available before each fraud was publicly revealed.

Fraud labels — wide net, four lanes

  • Tier A — SEC AAERs. 358 issuer-level Accounting & Auditing Enforcement Releases, hand-adjudicated from release text for the misstated period and the first public revelation date.
  • Tier B — non-reliance 8-Ks. 770 companies whose Item 4.02 filings carried fraud-flavored language (two or more markers), split from a benign-restatement placebo cohort.
  • Tier C — vindicated short reports. 43 activist short targets confirmed by delisting, deregistration, bankruptcy, or enforcement within 24 months.
  • Keyed by CIK; dated by earliest public revelation; the event that generated a label is never a feature for its own case.

Point-in-time discipline

  • As-filed only. For each concept and period we take the value from the earliest-filed 10-K — the original number, before any restatement rewrote the comparative. Fraud firms are precisely the firms whose prior years get rewritten.
  • Hard revelation cutoff. Every indicator uses only filings dated strictly before the revelation date. No look-ahead.
  • Controls. Up to four non-fraud firms matched on 2-digit SIC, asset size (0.5–2.0x), and fiscal year. Financials (SIC 6000–6999) excluded from the ratio backtest.

Statistics

Per indicator: fraud hit rate, control false-positive rate, Fisher odds ratio, rank AUC, and lead-time distribution. Significance uses Benjamini–Hochberg at q=0.10 across the full family. The composite is validated on a temporal split (train ≤2015, test 2016–2025) with whole cases kept on one side. Because fraud is rare (~0.3–0.8% of firm-years), we lead with precision economics — if you shorted every flag, how many were real — not odds ratios alone.

Sources: SEC EDGAR full-text search, DERA Financial Statement Data Sets (~89,000 as-filed 10-Ks; 56,332 firm-year observations), companyfacts XBRL, submissions API. Literature priors: Beneish (1999), Dechow et al. (2011), Karpoff et al. (2017), Dyck–Morse–Zingales (2010, 2023), Larcker–Zakolyukina (2012), and the activist-short and practitioner canon. Backtest sample: 327 matched fraud firm-years vs 1308 controls.

The sample

The union of the three fraud lanes yields 1070 distinct labeled companies. 100 appear in more than one lane — that overlap is itself a confidence signal. 27 are China-based ADRs, run separately as a robustness cut so the composite does not simply learn "is it a Chinese reverse merger."

Cases by revelation year

2005143
2006100
200776
200842
200940
201045
201154
201238
201340
201446
201531
201636
201727
201829
201932
202037
202128
202244
202331
202435
202538

What counts as fraud here

A wide net by design. Tier A is unambiguous — the SEC charged accounting fraud. Tier B captures fraud-flavored restatements that never became enforcement actions. Tier C captures the Luckin-class collapses short sellers caught before regulators did. Every result is also reported on the Tier-A-only subset, so you can see how much the wide net moves the conclusions.

Foreign-listed frauds (Wirecard, Steinhoff, Olympus, Autonomy, Tesco) are carried in the qualitative case forensics but excluded from the US ratio backtest, which requires EDGAR XBRL.

Findings by hypothesis

H1SUPPORTED

Classic manipulation scores (Beneish M, Dechow F) flag frauds in advance.

Dechow F-Score > 1.85 (OR 1.9, BH-sig), Dechow F-Score > 2.45 (high cut) (OR 1.9, BH-sig), Beneish M-Score > -1.78 (OR 1.0, n.s.)

H2SUPPORTED

Disclosure and governance events out-predict the accrual ratios.

Prior non-reliance (8-K 4.02) in trailing 24m (OR 3.3, BH-sig), Late filing (NT 10-K / NT 10-Q) (OR 3.3, BH-sig), Auditor change (8-K 4.01) (OR 2.1, BH-sig)

H3SUPPORTED

Receivables and revenue-quality tells fire when revenue is fabricated.

Deferred-revenue growth lagging revenue growth (OR 1.7, n.s.), Receivables growth / assets (top decile) (OR 1.6, BH-sig), Receivables-vs-revenue growth gap (top decile) (OR 1.1, n.s.)

H4SUPPORTED

A transparent flag-count generalizes better than a fitted model.

Flag-count test AUC 0.66 vs fitted logistic 0.55 on the same held-out window.

H5NOT SUPPORTED

Benford's-law digit anomalies predict fraud.

Benford deviation worsening (trajectory) (OR 1.3, n.s.), Benford deviation, lagged (top decile) (OR 1.1, n.s.)

H6NOT SUPPORTED

Capital-markets behavior (raising despite cash, dilution) marks the Luckin/Wirecard pattern.

Equity/debt issuance (S-1/S-3/424B) (OR 1.3, n.s.), Raising capital despite large cash balance (OR 0.6, n.s.)

H7NOT SUPPORTED

A high composite score predicts catastrophic corporate outcomes in the broad universe.

Top-decile flags delisted/went bankrupt no more than low-score names; broad corporate mortality tracks size and benign M&A, not fraud. The composite predicts labeled fraud, not delisting.

The tells, ranked

Every indicator, sorted by odds ratio. Hit rate is the share of frauds flagged; FPR the share of matched controls flagged; lead the median months before revelation the signal first fired. A check marks survival of Benjamini–Hochberg correction at q=0.10.

TellHit rateFPROdds ratioAUCLeadBH
Prior non-reliance (8-K 4.02) in trailing 24m11.2%3.7%3.2920 mo
Late filing (NT 10-K / NT 10-Q)32.8%13.0%3.2521 mo
Auditor change (8-K 4.01)20.6%11.2%2.0518 mo
Dechow F-Score > 1.8523.3%13.5%1.940.55
Dechow F-Score > 2.45 (high cut)15.6%9.0%1.870.55
Deferred-revenue growth lagging revenue growth28.7%18.9%1.720.53
10-K/A or 10-Q/A amendment34.1%23.7%1.66
Receivables growth / assets (top decile)21.4%14.2%1.640.52
Soft-assets ratio (top decile)15.1%11.6%1.350.54
RSST accruals (top decile)14.8%11.4%1.350.50
Benford deviation worsening (trajectory)13.5%10.4%1.340.53
Equity/debt issuance (S-1/S-3/424B)51.9%45.6%1.29
Sloan accruals (top decile)17.3%14.0%1.280.49
CFO minus net income gap (bottom decile)17.3%14.0%1.280.49
Officer/director departure (8-K 5.02)92.5%91.1%1.2040 mo
Serial officer exits (>=3)73.1%70.2%1.16
Goodwill + intangibles growth (top decile)9.8%8.9%1.110.51
Receivables-vs-revenue growth gap (top decile)12.5%11.6%1.100.46
Benford deviation, lagged (top decile)15.9%15.2%1.060.48
Dividend exceeds free cash flow7.0%6.9%1.020.50
Beneish M-Score > -1.7839.4%40.2%0.970.484 mo
Capex / D&A (top decile)8.3%8.6%0.960.51
Beneish M-Score > -2.22 (loose)43.9%46.0%0.920.48
Book-tax income gap (top decile)7.9%9.3%0.840.49
Raising capital despite large cash balance3.7%6.0%0.590.49
Low interest yield on reported cash2.7%9.7%0.260.44

Odds ratios are from matched case-control samples and overstate real-world usefulness because fraud is rare; the precision-economics section gives the base-rate-adjusted picture.

The composite & precision economics

Flag-count vs fitted model

Frauds carry a mean of 5.8 firing flags versus 4.0 for controls. The transparent count reaches AUC 0.66 in-sample and holds 0.66 out-of-sample.

A LASSO logistic on the same features drops to AUC 0.55 out of sample — it chased regime-specific patterns that did not repeat. Terms it kept: f_score (+0.23), benford_mad_lag (-0.15), benford_trajectory (-0.10), Raising capital despite large cash balance (-0.10), Dividend exceeds free cash flow (-0.06), interest_yield_on_cash (+0.06).

Train ≤2015 (76 cases), test 2016–2025 (251 cases). Whole cases kept on one side of the split.

The outcome test — an honest null

We took top-decile-flagged universe firm-years (2012–2023) and a low-score sample, then checked EDGAR for a catastrophic outcome within 24 months.

nCatastrophicDelistingBankruptcy
Top-decile flagged40015.5%12.5%1.2%
Low-score sample40013.8%10.0%1.8%

No separation. Broad delisting is dominated by benign M&A and going-private, which track size, not fraud. This is a feature of the honest test, not a failure of the tells: the composite predicts labeled fraud (AUC 0.7), not corporate mortality. Do not short a name because it might delist — short it because the fraud tells stack up.

Precision economics: if you shorted every top-decile flag

The odds ratios look powerful, but fraud is a ~2–3% base-rate event even in our enriched universe. Here is what a top-decile screen actually caught, year by year:

YearFlaggedReal fraudsPrecisionBase rateLift
201116063.8%4.4%0.8x
2012453316.8%3.6%1.9x
2013558254.5%3.2%1.4x
2014642233.6%3.2%1.1x
2015615254.1%3.1%1.3x
2016516224.3%3.3%1.3x
2017636274.2%3.1%1.4x
2018658152.3%2.9%0.8x
2019659182.7%2.7%1.0x
2020575203.5%2.4%1.5x
2021465194.1%2.3%1.8x
2022454153.3%1.9%1.7x
202357161.1%1.4%0.7x
202457881.4%0.9%1.6x
202512021.7%0.6%2.7x

Precision is a lower bound — undetected frauds (the ~2/3 that never surface, per Dyck–Morse–Zingales) sit in the "false positive" pile. The lesson stands: the composite narrows a 4,000-name universe to a few hundred, but human forensic work does the rest.

Error-detector or fraud-detector? The placebo test

A tell is only useful if it fires on fraud more than on honest mistakes. We built a placebo cohort of benign restaters — companies that filed non-reliance 8-Ks for clerical, tax, lease, or SPAC-warrant reasons with no fraud — and compared each tell's fraud rate to its benign-restater rate. Discrimination near 1.0x means the tell detects accounting errors, not fraud specifically.

TellFraud rateBenign-restater rateDiscrimination
Prior non-reliance (8-K 4.02) in trailing 24m11.2%0.0%
Serial officer exits (>=3)73.1%32.9%2.2x
Deferred-revenue growth lagging revenue growth28.7%15.4%1.9x
10-K/A or 10-Q/A amendment34.1%18.3%1.9x
Raising capital despite large cash balance3.7%2.0%1.8x
Dividend exceeds free cash flow7.0%4.1%1.7x
Receivables growth / assets (top decile)21.4%15.2%1.4x
Officer/director departure (8-K 5.02)92.5%66.1%1.4x
Late filing (NT 10-K / NT 10-Q)32.8%24.8%1.3x
Dechow F-Score > 1.8523.3%18.5%1.3x
Auditor change (8-K 4.01)20.6%17.5%1.2x
Dechow F-Score > 2.45 (high cut)15.6%13.3%1.2x
Capex / D&A (top decile)8.3%7.7%1.1x
Beneish M-Score > -1.7839.4%37.9%1.0x
Beneish M-Score > -2.22 (loose)43.9%42.7%1.0x
CFO minus net income gap (bottom decile)17.3%17.9%1.0x
Sloan accruals (top decile)17.3%17.9%1.0x
Goodwill + intangibles growth (top decile)9.8%10.6%0.9x

Tells near 1.0x are financial-quality flags, not fraud edge — useful for avoiding restatement risk generally, but they will not distinguish a fraud from a sloppy accounting department.

Who actually catches fraud

First public detector, across the case set

Activist short seller31%
Investigative journalist25%
Company self-disclosure19%
SEC / regulator12%
Sell-side analyst6%
Auditor6%

Auditors and the SEC are structurally late — they arrive after the market-facing detectors. This updates Dyck–Morse–Zingales (2010) for the short-seller era.

Signals the detectors actually used

  • T11.6 — 8 cases
  • T5.1.1 — 8 cases
  • T1.1.1 — 5 cases
  • T1.2.1 — 4 cases
  • T3.4.4 — 4 cases
  • T3.4.1 — 4 cases
  • T5.4.2 — 4 cases
  • T1.3.6 — 4 cases
  • T4.2.1 — 4 cases
  • T4.5.1 — 4 cases

Case forensics: the tells in context

For each landmark fraud we reconstructed which tells were visible, and when, from contemporaneous public sources only. The pattern repeats: the signal was on the tape a year or more before the collapse.

UNITEDHEALTHGROUP 2006Investigative journalist · options_grant_date_timing_anomaly

From 1994 through 2005 UnitedHealth systematically backdated at-the-money employee stock option grants, choosing grant dates coinciding with historically low quarterly closing prices so options were secretly in-the-money at issuance. This let the company avoid recording compensation expense under APB 25, overstating earnings, while enriching insiders. CEO/Chairman William McGuire, given rare latit

  • T-107mo Option grant-date timing anomaly (backdating)
  • T-83mo Founder/CEO dominance with compliant board
  • T-32mo Extreme option-heavy / in-the-money CEO compensation
  • T-9mo Investigative journalism naming the firm
  • T-8mo Disclosed SEC / IRS / DOJ (SDNY) investigation

Earliest catchable: T1.1.5 option grant-date timing anomaly. UNH's grant dates were disclosed in proxy statements from the mid/late-1990s; McGuire's 1997/1999/2000 grants each fell on that year's single lowest closing price. Running Lie/Heron's abnormal-return event study on those public grant dates (the exact method WSJ used for its ~1-in-200-million estimate) would have surfaced the anomaly years before the 2006-03-18 article and ~9 years (~107 months) before the 2006-12-19 charge quantification. It is 'catchable' but costly: pre-2002 grant dates lived only in annual proxies and demanded a bespoke statistical screen, which is why no one ran it at scale until Lie's 2005 academic paper. ~107 months before the reveal.

SINOFOREST 2011Activist short seller · forensic_accounting_tells_v1

From at least 2007 through 2011 (OSC found ~70% of claimed standing-timber hectares and ~70% of 2007-2010 revenue unverifiable), Sino-Forest and CEO Allen Chan ran an asset-and-revenue overstatement built on circular, related-party trade. BVI subsidiaries 'bought' standing timber from PRC suppliers and 'sold' it to 'Authorized Intermediaries' (AIs) and nominee customers that were secretly controll

  • T-196mo Reverse-merger listing route: 1994 reverse takeover of a dormant Alberta shell, then graduated to TSX (1995)
  • T-53mo Earnings-quality / cash-yield anomaly: ~50%+ reported margins but perpetually NEGATIVE free cash flow (business funded by other people's money, never self-funding)
  • T-53mo Insider sales into strength: executives sold ~C$81M of stock (2006-2011), incl. co-founder Poon ~C$30.1M, CFO Horsley ~C$11.2M, Chan ~C$3M, during the multi-year run-up
  • T-47mo Auditor size/scope mismatch for a China-wide forestry roll-up (small first auditor BDO 2005-06; audit defeated by AI/invoice-only documentation even under E&Y 2007-2010)
  • T-26mo Byzantine structure / opaque jurisdictions: 40+ PRC subsidiaries and ~16 BVI entities, with 'Authorized Intermediary' trade layer that avoided verifiable documentation

Earliest catchable: The loudest LEADING, machine-readable ex-ante tell was the cash-flow-vs-earnings and capital-dependence signature visible across the annual filings for years: a company reporting gross/operating margins often above 50% that was, in its own cash-flow statements, almost perpetually FREE-CASH-FLOW NEGATIVE, plugging the gap by raising ~US$3.0 billion of equity and convertible/senior notes from 2003 through 2010 (Annual Information Form 2010 and prior; multiple 2009 note+share offerings). A high-margin business that never self-funds and must continuously tap capital markets to buy more of an unverifiable asset (standing timber held via BVI subsidiaries and traded through related 'Authorized Intermediaries') is the classic asset/revenue-overstatement funded-by-financing pattern later confirmed by the OSC. Corroborating structural tells were observable even earlier and continuously: the 1994 reverse-takeover listing of a dormant Alberta shell; a byzantine structure (40+ PRC subsidiaries, 16 BVI entities); disclosed related-party dealing; a small first auditor (BDO 2005-06) for a China-wide forestry roll-up; and GMI's 'Aggressive' governance rating from Q3 2008, worsening to 'Very Aggressive' in Dec 2010. None required non-public data; the cash-flow analysis is pure ratio work on the audited statements. Set ~60 months pre-revelation as the point at which the financing-dependence + structural pattern was already fully visible in filings; the Homix related-party deal (Jan 2010) sharpened it ~17 months out. ~60 months before the reveal.

BIOVAIL 2008Sell-side analyst · David Maris (Banc of America Securities equity research analyst), Oct 8 2003 SELL report

Biovail, a Canadian pharma (NYSE/TSX, foreign private issuer filing 20-F/6-K), was charged by the SEC (Mar 24 2008) with chronic financial-reporting fraud driven by an obsession with hitting earnings guidance. Four schemes: (1) a special-purpose entity, Pharmatech (Barbados), that carried ~$47M of R&D expense and ~$51M of liabilities off Biovail's books in 2001-02, inflating net income up to ~50%

  • T-76mo Opaque offshore jurisdictions / byzantine structure (Barbados SPE + Cayman trusts)
  • T-76mo Capital raise into materially misstated numbers (legitimacy/dilution on inflated financials)
  • T-55mo Founder borrowed against stock; ownership held through undisclosed nominee trusts
  • T-53mo Earnings-call deception markers (false factual claims on live analyst call)
  • T-53mo Never-miss-guidance streak ending abruptly (earnings-management fragility)

Earliest catchable: The Oct 8 2003 BofA sell report (David Maris) is the earliest clean, public, contemporaneous flag that the truck-accident story was implausible and revenue recognition suspect - ~53 months before the Mar 24 2008 SEC charges and observable in real time by any investor reading sell-side research. Even earlier, the Oct 3 2003 press release/call itself was internally inconsistent (a truck said to carry $10-20M of a product whose whole-quarter Wellbutrin XL revenue was stated as <$10M), catchable ex ante by a skeptical reader ~53.7 months out. The Pharmatech SPE and the $587.5M Nov 2001 raise into inflated numbers were latent but not externally provable until the 2004 restatements/2008 charges. ~53 months before the reveal.

NOVASTARFINANCIAL 2007Investigative journalist · Herb Greenberg (TheStreet.com); Marc Cohodes / David Rocker (Rocker Partners) as short-seller; Wall Street Journal (2004 branch investigation)

NovaStar was a Kansas City subprime-mortgage REIT (co-founders Scott Hartman, CEO, and Lance Anderson, President/COO). It securitized subprime loans and booked large up-front gain-on-sale income by valuing retained residual/IO interests with aggressive, self-selected assumptions (low discount and credit-loss rates), producing GAAP income far ahead of real cash. That phantom income funded a rich RE

  • T-48mo Investigative journalism / sustained skeptical financial-press coverage
  • T-45mo Insider sales into strength
  • T-39mo Dilution treadmill / raise-despite-distribution (equity raises funding the dividend)
  • T-36mo Site-check / local-filing contradiction (branch network largely unlicensed or non-existent)
  • T-35mo Founder dominance (entrenched co-founder control) + founder prior-model exposure

Earliest catchable: Herb Greenberg's first skeptical column (TheStreet.com, 2003-02-27) questioning whether NovaStar's earnings and REIT dividend were backed by cash - the exact defect that surfaced four years later - was publicly observable at zero cost ~48 months before the 2007-02-20 revelation. A hard, verifiable ex-ante contradiction (Nevada cease order / unlicensed-and-non-existent branches, Feb-Apr 2004) was observable ~34-36 months out and is the more objectively 'catchable' signal for a systematic screen. ~48 months before the reveal.

BALLYTOTALFITNESS 2005Company self-disclosure · forensic_accounting_tells_v1

From 1997 through 2003 Bally overstated income and net worth via premature revenue recognition and expense deferral. It recognized one-time initiation fees far faster than the estimated membership life; booked entire prepaid renewal dues in the month received; and, most egregiously, accrued 'reactivation' revenue on hypothetical lapsed members projected up to three years into the future, with no b

  • T-20mo Deception marker: $631.6M charge reframed as a voluntary 'clarity/simplicity' change, not error correction
  • T-20mo Late filing NT (10-K/10-Q): serial delinquency beginning with FY2003 10-K
  • T-20mo Auditor resignation (Ernst & Young) mid-scandal
  • T-20mo Accounting-method switch used to bury an uncorrected error (deferral -> 'modified cash') for reactivation and initiation fees
  • T-19mo CFO departure (John W. Dwyer) as SEC probe opened

Earliest catchable: The single loudest ex-ante public tell was the Mar 12 2004 NT 10-K (late-filing notice) paired with the Mar 11 2004 earnings release, ~20.6 months before the Nov 30 2005 restated 10-K. A forensic reader would flag the contradiction: management booked a $631.6M non-cash charge yet called it a discretionary 'change... to bring increased clarity and simplicity,' not an error correction, and simultaneously restated ~$43M of prepaid dues for 'errors... accelerating dues recognition.' Coupled with the E&Y resignation (Mar 30 2004) and CFO exit (Apr 28 2004) within weeks, the cluster was unmistakable. Deeper, a forensic reader of the 2002-2003 10-Ks could question the reactivation-revenue accrual on non-obligated lapsed members and the 22-month membership-life assumption years earlier, but those were not overtly flagged until 2004. ~20 months before the reveal.

LONGTOPFINANCIAL 2011Activist short seller · china_rto_forensic_cash_ex_ante

Longtop, a Xiamen-based bank-software vendor that IPO'd on the NYSE in Oct 2007 (Deutsche Bank/Goldman-underwritten, Deloitte-audited), fabricated cash and bank balances from its IPO onward to support fake revenue and impossibly high margins. Real operating costs (notably staff) were parked off-balance-sheet in a nominally independent HR entity, Xiamen Longtop Human Resource Services (XLHRS), that

  • T-43mo Legitimacy dividend (Big-4 auditor + bulge-bracket underwriters + NYSE IPO masking risk)
  • T-34mo Byzantine structure / opaque jurisdictions (Cayman holdco, HK + Xiamen ops)
  • T-18mo Raise-despite-cash (capital raise inconsistent with reported liquidity)
  • T-18mo Dilution treadmill (serial equity raises despite claimed cash sufficiency)
  • T-10mo Interest-income-vs-cash-yield anomaly (huge reported cash earning implausibly little)

Earliest catchable: Raise-despite-cash + interest-yield anomaly: on 2009-11-18 Longtop priced a ~$110M primary ADS offering (3.7M ADSs at ~$32) 'for potential acquisitions and general corporate purposes' while its balance sheet already reported a very large, low-need cash pile earning implausibly little interest. A cash-generative software firm with no capex need diluting shareholders to raise cash it claims to already have is the single cheapest ex-ante red flag, observable in the 424B5 and the FY2010 20-F ~18 months before the May 2011 revelation. ~18 months before the reveal.

COLONIALBANCGROUPTBW 2009SEC / regulator · forensic_accounting_tells_v1

From ~2002 to Aug 2009, Taylor, Bean & Whitaker (TBW), Colonial Bank's largest mortgage-warehouse customer, and Colonial insiders concealed TBW overdrafts by selling Colonial fictitious and impaired mortgage assets (dubbed 'Plan B' fake loans and 'Crap' impaired loans), plus fake trades in Colonial's securities-purchased-under-agreements-to-resell and loans-held-for-sale lines. Colonial Bank recor

  • T-15mo Prior-period accounting error self-corrected in the exact fraud account (derivatives + loans held for sale)
  • T-6mo Partial-disclosure / omission shock: undisclosed $300M capital condition on the Dec-2008 TARP 'approval' (later charged as securities fraud)
  • T-5mo Going-concern doubt disclosed by management
  • T-5mo Regulatory enforcement pressure: informal MOUs / heightened scrutiny with FDIC and Federal Reserve
  • T-5mo Custodial / third-party asset reliance: warehouse assets held as securities-purchased-under-agreements-to-resell tied to mortgage customers

Earliest catchable: The earliest hard, filing-based ex-ante signal was the Q1-2008 prior-period error correction disclosed in the Form 10-Q filed 2008-05-05 (~15 months before the Aug-2009 revelation) and repeated in the FY2008 10-K (2009-03-02): management recorded a $4.0M net ($6.6M pretax) cumulative 'inadvertent error' charge for prior years 'principally relating to the accounting for derivatives and the carrying value of loans held for sale.' Loans-held-for-sale / warehouse resale assets are exactly the accounts where TBW's fake assets hid, so a forensic reader would treat a self-corrected error in that specific line as a live control-quality flag. This is faint on its own; combined with founder-dominated control, an oversized single-customer warehouse book, and (from Dec 2008-May 2009) going-concern + MOUs, an ex-ante skeptic had a mosaic well before the raid. The true asset fraud, however, was invisible in the audited numbers (PwC issued a clean, effective-ICFR opinion), so the practical earliest catch was low-confidence. ~15 months before the reveal.

DIAMONDFOODS 2011Investigative journalist · forensic_accounting_tells_v1

From at least Q2 FY2010 (Feb 2010) through Sep 2011, Diamond Foods and CFO Steven Neil underreported the cost of walnuts to inflate EPS and beat analyst consensus every quarter. Neil (1) adjusted quarterly walnut-cost accruals to hit EPS targets (e.g., cutting the Q2 FY2010 estimate from 82 to 72 cents/lb), and (2) recast two extraordinary year-end grower payments as advances for future crops rath

  • T-20mo Serial acquisitions / debt-funded roll-up with near-zero cash (Pop Secret 2008, Kettle 2010, Pringles pending)
  • T-20mo Equity raise (~$181M, Mar 2010) and stock-as-consideration acquisition while earnings overstated (capital-markets dependence / legitimacy dividend)
  • T-19mo Suspiciously perfect meet-or-beat EPS streak ('Twelve Consecutive Quarters of Outperformance')
  • T-12mo Earnings-quality / margin-physics anomaly: FY2010 operating cash flow NEGATIVE $1.6M vs ~$50M reported net income; net margin expanded 1.5%->5% while walnut costs spiked
  • T-11mo EPS/target-linked executive compensation (CEO bonus paid for beating EPS goals)

Earliest catchable: The single loudest LEADING, machine-readable tell was the earnings-quality divergence in the FY2010 Form 10-K (filed 2010-10-05, ~12.9 months before the 2011-11-01 revelation): Diamond reported ~$50M net income and touted '52% earnings growth' and raised FY2011 EPS guidance, yet cash flow from OPERATIONS was NEGATIVE $1.6M for FY ended 2010-07-31 (per the FY2011 10-K comparative). A company whose accrual earnings surge while operating cash goes negative -- in a commodity-cost business where the largest input (walnuts) was spiking -- is the classic cookie-jar/cost-deferral signature later confirmed. Net margin also expanded from ~1.5% (FY2006) to ~5% (FY2011) despite rising walnut prices (a margin-physics anomaly). Corroborating structural tells were visible by early-mid 2010: a perfect multi-year EPS beat streak ('Twelve Consecutive Quarters of Outperformance', investor deck 2010-03-10), EPS-linked CEO bonuses (~$2.6M of Mendes' $4.1M FY2009-11 bonus paid for beating EPS goals), an aggressive acquisition roll-up (Pop Secret 2008, Kettle 2010) leaving cash near zero and debt rising, and a $181M equity raise (Mar 2010) using an inflated stock. None required non-public data. ~12 months before the reveal.

DELL 2007SEC / regulator · forensic_accounting_tells_v1

From FY2002 through FY2006, Dell, CEO Michael Dell, then-CEO Kevin Rollins and CFO James Schneider misrepresented how Dell met consensus EPS every quarter. Large undisclosed exclusivity payments from Intel (paid so Dell would not adopt AMD CPUs) were the swing factor: without them Dell would have missed consensus every quarter. Intel money rose from ~10% of operating income (FY2003) to 38% (FY2006

  • T-54mo Insider selling into strength (executives sold ~$3.3B into 2003-2006 price run-up)
  • T-51mo Suspiciously consistent meet-or-beat consensus streak (FY2002-FY2006)
  • T-11mo Disclosed SEC informal inquiry + audit-committee investigation + DOJ/SDNY subpoena into accruals and reserves
  • T-11mo Earnings-call deception markers: false attribution of the Q2 FY2007 profit drop
  • T-11mo Serial NT (late) filings driven by the investigation (Q2/Q3 FY2007 10-Qs, FY2007 10-K, Q1 FY2008 10-Q)

Earliest catchable: The single loudest LEADING signal any investor could act on was the 2006-08-17 disclosure of the SEC informal accounting inquiry AND a simultaneous audit-committee independent investigation into accruals, reserves and other balance-sheet items (Form 8-K, event/filed 2006-08-17, acc 0001157523-06-008578), ~11.9 months before the 2007-08-16 non-reliance 8-K. It was immediately corroborated by an inability to file the Q2 FY2007 10-Q, a NASDAQ delinquency notice (2006-09-15), and an SDNY subpoena. A forensic reader also had a truly ex-ante structural tell earlier: Form 4s showing ~$3.3B of insider selling into 2003-2006 price strength (stock $22.59->$42.57), the largest such insider disposition on record at the time, later aggregated in the Jan-2007 shareholder suit. Combined with a suspiciously perfect FY2002-FY2006 meet-or-beat streak, the reserve/earnings-quality risk was visible well before the restatement. ~11 months before the reveal.

RINOINTERNATIONAL 2010Activist short seller · Muddy Waters LLC

RINO, a Dalian-based maker of flue-gas desulfurization (FGD) and wastewater equipment for Chinese steel mills, reached NASDAQ via a 2007 reverse merger into Nevada shell Jade Mountain Corp. It reported FY2009 revenue of $192.6M while its own Chinese SAIC/tax filings showed roughly $11M; the SEC found RINO kept two sets of books (~$31M Chinese sales for Q1'08-Q3'10 vs hundreds of millions in US fil

  • T-37mo Reverse-merger route into US listing via Nevada shell (Jade Mountain Corp), Oct 2007
  • T-26mo Prior non-reliance/restatement (2008) of FY2006-2007 financials - recidivism before the main fraud
  • T-19mo Tiny US auditor / size mismatch for a ~$190M-revenue NASDAQ issuer with all operations in China
  • T-12mo New principal accounting officer (Controller) installed weeks before the ~$100M offering and at year-end
  • T-12mo VIE-style contractual-control structure over the operating PRC affiliates

Earliest catchable: Free-EDGAR gatekeeper stack was visible ~10 months pre-collapse: the year-end auditor reconstitution into Frazer Frost, expressly NOT PCAOB-registered when engaged (8-K 4.01, 2010-01-07), on top of a prior 2008 restatement (8-K 4.02), a tiny CA auditor for ~$190M China ops, serial CFO/controller churn around the uplist and $100M raise, and 90/10 husband-wife control via a BVI trust. None required field work. The revenue fabrication itself was catchable at ~$0 cost by comparing the Chinese SAIC filing to the SEC 10-K - exactly what Muddy Waters monetized on 2010-11-10. ~10 months before the reveal.

LEHMANBROTHERS 2008Activist short seller · forensic_accounting_tells_v1

Lehman, a broker-dealer under SEC Consolidated Supervised Entity oversight, used 'Repo 105/108' to window-dress its quarter-end balance sheet in FY2007-08. It moved fixed-income inventory to (mostly European) counterparties as repos with >=5% haircuts, booking them as true sales under SFAS 140 (relying on a Linklaters English-law opinion because no US firm would opine), so ~$38.6B (Q4'07), $49.1B

  • T-9mo Earlier public short calls: Value Investing Congress (Nov 2007) and Grant's Spring Conference (Apr 2008)
  • T-9mo Insider sales into strength (CEO Fuld's large stock sales 2000-2008)
  • T-5mo Management blames short-sellers / manipulation for stock weakness
  • T-5mo Non-GAAP leverage metric ('net leverage' on tangible equity) that flattered a Repo-105-shrunk balance sheet
  • T-5mo Mark/valuation physics anomaly: write-downs far smaller than comparable market moves (Level 3/CDO/CMBS/CRE)

Earliest catchable: Einhorn's 2007-11-29 Value Investing Congress presentation (stock ~$64) is the earliest clean public flag that Lehman's illiquid real-estate/Level 3 marks and ~30x leverage were unsound - ~9.6 months before the 2008-09-15 collapse and observable by any investor following the conference/press. The thesis hardened at Grant's (2008-04-08, ~5.3 mo out) and the Ira Sohn 'Accounting Ingenuity' speech (2008-05-21, ~3.8 mo out), which documented a $1.1B Level 3 discrepancy and demanded a capital raise. The Repo 105 mechanism specifically was NOT catchable from filings (EDGAR full-text search returns zero hits for 'Repo 105' in LEH filings); its visible proxy was the abnormally large, too-clean quarter-end deleveraging in the Q1/Q2 2008 10-Qs. ~9 months before the reveal.

PUDACOAL 2011Activist short seller · Alfred Little (and GeoInvesting), independently, both 2011-04-08

Puda Coal, a Shanxi coal company that entered US markets via a 2005 reverse merger into shell Purezza Group, held its sole revenue asset through a 90% indirect stake in operating subsidiary Shanxi Coal. On 2009-09-03, chairman Ming Zhao secretly transferred that entire 90% stake to himself, weeks before Puda announced Shanxi Coal had won a lucrative provincial coal-consolidation mandate. In July 2

  • T-69mo Reverse-merger route into US listing
  • T-19mo Related-party self-dealing / undisclosed related-party asset transfer
  • T-12mo Offshore VIE / byzantine cross-border structure (BVI -> PRC WFOE -> operating co)
  • T-8mo Local-filing / site-check contradiction (SAIC records vs. SEC disclosure)
  • T-4mo Raise-despite-cash (large equity offering while cash-rich)

Earliest catchable: T4.4.1 - SAIC local-registry contradiction. The July 2010 CITIC Trust sale/pledge of Shanxi Coal was registered in Shanxi SAIC records, which are publicly obtainable in China. A diligent short seller running a China local-filing check against Puda's claimed 90% ownership could have discovered the discrepancy from roughly Q3/Q4 2010 (~8 months before the 2011-04-08 report). The Sept-2009 self-transfer was in principle catchable ~19 months out, but the CITIC step made the theft unambiguous and is the conservative earliest-catchable anchor. ~8 months before the reveal.

Running it on a live ticker

The framework is mechanical. For any US filer, pull the last three 10-Ks and the trailing-24-month 8-K/NT stream from EDGAR and score:

  1. Event stream first. Prior non-reliance (4.02), auditor change (4.01), late filings (NT), serial officer exits (5.02), material-weakness disclosures. Highest-odds tells, free to read.
  2. Then the ratios. Beneish M-Score and Dechow F-Score from as-filed numbers; receivables-vs-revenue growth gap; deferred-revenue divergence; Sloan/RSST accruals; goodwill growth; Benford deviation and its trajectory.
  3. Then the structure. Auditor-size mismatch, opaque jurisdictions/VIE, reverse-merger origin, serial acquisitions, raising capital despite a cash fortress.
  4. Count the flags, do not fit a model. Sum firing flags (one per dedupe family). A top-decile count is your shortlist; the forensic work — site checks, customer verification, short-report review — confirms.
  5. Check the placebo. If the only flags are error-detectors (discrimination near 1.0x), it is restatement risk, not fraud edge.

The twelve highest-yield checks

Limitations & robustness

What could bias these results

  • Detection censoring. Our labels are caught frauds. Dyck–Morse–Zingales estimate only ~1/3 of fraud is ever detected, and tells correlated with detector attention look stronger than they are. Every result is conditional on getting caught.
  • XBRL coverage. The ratio backtest effectively begins ~2012 (small-cap XBRL phase-in); pre-2009 frauds contribute only event-based tells. The train window is thin.
  • Wide-net labels. Tier B/C add label noise. We report Tier-A-only cuts throughout; the ranking is stable, the magnitudes move.
  • Survivorship in controls. Some "controls" may be undetected frauds, biasing false-positive rates upward — a conservative error.

What we did to harden it

  • As-filed first-reported data only — no restated-comparative contamination, verified by hand on known restaters.
  • A shared revelation-date gate on every feature; label-generating events excluded as features for their own case.
  • Benjamini–Hochberg correction; temporal out-of-sample split with case-level separation.
  • A benign-restatement placebo cohort to separate error-detectors from fraud-detectors.
  • China-ADR and Tier-A-only robustness cuts so the composite is not just learning one archetype.

Research only. Exposure and base rates, not investment advice. A high composite score is a statistical prior for further work, not an accusation against any company.

Data appendix: robustness cuts

Top tells under alternative samples — adjudicated-only (Tier A), excluding China ADRs, and the out-of-sample test window.

SubsetTellHit rateFPROdds ratioBH
tierA_onlyOfficer/director departure (8-K 5.02)97.6%91.1%3.90
tierA_onlyLate filing (NT 10-K / NT 10-Q)26.8%13.0%2.44
tierA_onlyDeferred-revenue growth lagging revenue growth35.7%18.9%2.38
tierA_onlyDechow F-Score > 1.8526.8%13.5%2.34
tierA_onlyDechow F-Score > 2.45 (high cut)18.3%9.0%2.26
tierA_onlyPrior non-reliance (8-K 4.02) in trailing 24m6.1%3.7%1.68
ex_chinaPrior non-reliance (8-K 4.02) in trailing 24m11.0%3.7%3.22
ex_chinaLate filing (NT 10-K / NT 10-Q)32.5%13.0%3.21
ex_chinaDechow F-Score > 1.8523.5%13.5%1.96
ex_chinaAuditor change (8-K 4.01)19.9%11.2%1.96
ex_chinaDechow F-Score > 2.45 (high cut)15.8%9.0%1.89
ex_chinaDeferred-revenue growth lagging revenue growth28.0%18.9%1.66
testLate filing (NT 10-K / NT 10-Q)30.7%14.9%2.54
testAuditor change (8-K 4.01)21.3%12.1%1.97
testPrior non-reliance (8-K 4.02) in trailing 24m8.6%4.8%1.87
testDechow F-Score > 2.45 (high cut)16.2%9.8%1.77
test10-K/A or 10-Q/A amendment30.7%20.8%1.69
testDechow F-Score > 1.8522.4%15.2%1.60

Full per-indicator tables across all subsets are in outputs/stats_univariate.csv. The 193-tell taxonomy and the scorability contract are in the project qual/ directory.