Former Bank Cash Vault Manager Sentenced to 10 Years in Federal Prison for Stealing over $4 Million – Case Reveals Gaps in “Dual Control” Training
The scheme involved an “ice cream social” as an excuse to stay late, a private jet paid for with stolen bank funds, and training to get around dual controls
According to the US Attorney for Alaska, on April 29, 2019, Gerardo Valenzuela aka Gary Cazarez was sentenced to serve 10 years in prison after pleading guilty to stealing more than $4.3 million from the cash vault of KeyBank in Anchorage Alaska. The theft occurred on July 26, 2011, and Valenzuela fled to Mexico. He was arrested by Mexican authorities on Aug. 2, 2011, when a random search of his luggage at an internal (Mexico) checkpoint revealed $3.8 million in cash, firearms, and ammunition. Cazarez was charged and convicted in Mexico of criminal offenses analogous to money laundering and illegal possession of firearms for smuggling the cash and firearms into Mexico. After serving a term of seven years in prison for his Mexican conviction, Cazarez was extradited to the U.S. to face the Alaska bank theft charges.
The theft was well conceived, well planned, and well executed. It also reveals a few interesting potential gaps that banks could have in their controls and training programs. The US Attorney’s press release tells the story:
According to court documents, on or about July 29, 2011, Valenzuela was the Vault Manager for KeyBank when he stole approximately $4.3 million dollars in U.S. Currency from KeyBank in Anchorage, and then flew in a chartered jet to Washington, bought a car, obtained an AK-47 for protection and drove to Mexico. He mailed his and his girlfriend’s cell phones to Florida and New York to throw off investigators. The investigation revealed that Valenzuela’s motive to rob his employer was his concern that Keybank was going to make his position obsolete and he would be out of a job.
Months prior to his theft, Valenzuela told his girlfriend that he could rob the bank noting that the bank had video surveillance, but no physical surveillance at that time. In June 2011, he started to put his plan into action, which began with requesting that his brother obtain a firearm for him. On July 8, 2011, Valenzuela falsely trained new employees on vault procedures, effectively removing dual controls over the vault and laying the groundwork for his ability to steal $4.3 million a few weeks later.
Here are the first two potential control gaps. First, the bank video surveillance but no physical surveillance. Second, he was able to falsely train new employees on vault procedures, effectively removing dual controls over the vault.
On July 26, 2011, Valenzuela purchased an airplane ticket for his girlfriend from Anchorage to Seattle. Two days later, he then stole $30,000 from Keybank, which he used $24,000 to rent a private jet for himself to make his escape the next day. On the day of his theft, July 29, 2011, Valenzuela told the branch manager he was going to organize an ice cream social for bank customers, giving him an excuse to stay late as he cleaned up. Late at night and without dual controls in place, Valenzuela was able to access the vault without another employee present. He boxed up $4.3 million in cash, rolled it out of the vault to his car in the parking lot, and loaded the money into his car. Valenzuela drove to where the private jet was waiting for him in Anchorage and he flew to Seattle.
Valenzuela had set the timer on the vault lock for the maximum time allowable, giving him six days to escape to Mexico. By the time Keybank discovered his theft, Valenzuela and his girlfriend were already in Mexico; however, Valenzuela was arrested by Mexican authorities on Aug. 2, 2011, when a random search of his luggage at a checkpoint revealed $3.8 million in cash, firearms, and ammunition.
Here is the third control gap: the vault manager was able to set the timer on the vault lock for six days. July 29, 2011 was a Friday, so at most the vault timer should have been set for two days, not six.
Cazarez was charged and convicted in Mexico of criminal offenses analogous to money laundering and illegal possession of firearms for smuggling the cash and firearms into Mexico. After serving a term of seven years in prison for his Mexican conviction, Cazarez was extradited to the U.S. for the crimes charged in the superseding indictment.
Chief Judge Burgess noted that the most important sentencing factors in this case were the “magnitude of the crime” and Valenzuela’s lack of candor with the court. At the sentencing hearing, evidence was presented that Valenzuela had executed a “fail safe plan” that included stashing $500,000 in Washington before he fled to Mexico so that if he were caught he would still have money when he was released. That money has still not been recovered.
Appropriate controls on the timers on vaults, and ensuring there is physical surveillance to supplement any video surveillance, are two controls that should be in place for most financial institutions. But the most interesting control breakdown was around training the staff on appropriate dual control procedures. As the very name – dual – suggests, these controls are intended to involve (at least) two people on the theory that it is much harder for two people to conspire and act together than it is for one person to act alone. But if the person doing the training is both corrupt and one of the two people involved in the execution of the dual control, that control is ineffective, and the innocent person that received the fraudulent training is none the wiser.
So … all institutions that have dual controls, check to see who is doing the training: it cannot be one of the people involved in the execution of that control!