Catching Shell-Company Vendor Fraud in HOA Reserves
Insurers now rank shell-company vendor fraud among rising D&O exposures, and association reserves are the target. The defense is a continuously maintained paper trail, not an annual audit.
The short answer
Shell-company vendor fraud drains HOA reserves through fabricated or hijacked vendors, duplicate invoices, and altered banking details. Detect it by cross-referencing vendor identity, W-9s, COIs, banking changes, and invoice patterns continuously, not annually. Red flags include round-number invoices, PO-box addresses, missing insurance, and sudden payment-detail changes just before large disbursements.
How a shell-vendor scheme quietly drains reserves
A shell-vendor scheme drains reserves by routing association money to a company that either does not exist or exists only on paper. The classic version: someone with access sets up "Coastal Waterproofing LLC," opens a bank account, and starts submitting invoices for reserve-funded work like roof coating or concrete restoration that is easy to under-inspect.
The invoices look ordinary. They land during budget season or right after a special assessment, when cash is flowing and nobody is scrutinizing a $14,000 payment among fifty others. The work is partially done, or done by a cheaper crew, or not done at all. The margin becomes the theft.
The more sophisticated variant hijacks a real vendor. A fraudster emails the manager, claims the vendor "switched banks," and asks that the next payment go to a new account. The vendor is legitimate. The banking detail is not. One redirected reserve draw can be six figures.
The core problem
Reserve accounts are the target because they hold the most money and get reviewed the least often. Operating expenses recur monthly and draw attention. Reserve disbursements are large, infrequent, and tied to projects few board members can independently verify, which is exactly where fabricated vendors hide.
Why the board gets sued when reserve money vanishes
When reserve funds disappear, the board is the party with fiduciary duty, so the board is who owners and their attorneys come after. It rarely matters that a manager, a vendor, or an insider executed the theft. The question in every deposition is whether the directors exercised reasonable diligence over the money they were entrusted to protect.
This is why insurers now flag shell-company vendor fraud in Directors and Officers (D&O) underwriting. A board that approved payments to an unverified vendor with no COI, no W-9, and a PO-box address looks negligent even if it was merely busy. "We trusted our management company" is not a defense that holds up well.
The uncomfortable truth: most boards cannot currently prove they vetted anyone. They can produce invoices they paid. They cannot produce the trail showing they checked who they paid, when the banking details changed, or whether the insurance was ever real.
The red-flag checklist before you cut a reserve check
Most shell-vendor fraud trips at least three of the flags below. No single item proves anything. A cluster of them on a large reserve disbursement is where a manager should stop and verify before payment leaves the account.
Checklist
0/12Reserve disbursement fraud screen
The single highest-yield check is the banking-change flag. Legitimate vendors do change banks, but a verbal callback to a known phone number (not one from the change-request email) catches almost every hijack. It takes ninety seconds and it is the step people skip when they are behind.
Why continuous screening beats the annual audit
An annual audit finds shell-vendor fraud after the money is gone, if it finds it at all. Audits sample transactions and confirm balances. They are not designed to catch a $14,000 payment to a plausible-looking LLC in month four, and by the time the audit runs the following year the account is drained and the shell is dissolved.
Continuous screening runs the same checks the audit would, but on every disbursement, in real time. A screening agent cross-references each vendor against its own W-9 and COI on file, flags any banking-detail change, compares invoice patterns across the portfolio, and surfaces the cluster of red flags before the payment is released rather than a year later.
This is exactly the pattern behind agents like Victor, One Home Agent's vendor agent: it does not decide who is a fraud. It maintains the record. Every COI expiration, every license, every W-9, every banking change gets logged and matched, so anomalies rise to a human instead of hiding in an inbox of two hundred invoices.
| Capability | Annual audit | Continuous screening agent |
|---|---|---|
| Timing | Once a year, after the fact | Every invoice, before payment |
| Coverage | Sample of transactions | Every vendor, every disbursement |
| Banking-change detection | Rarely, unless flagged | Flagged the moment details change |
| Duplicate-invoice catch | Sometimes, if sampled | Cross-checked portfolio-wide |
| COI / W-9 gaps | Noted retroactively | Enforced at intake and renewal |
| Result when fraud exists | Discovered after loss | Stopped before disbursement |
The paper trail is the real product
The point of continuous screening is not to accuse vendors. It is to build a fiduciary paper trail the board can stand on. Most vendors are legitimate and most invoices are fine. The value is that when something goes wrong, or when an owner alleges the board was careless, the record already exists.
That record does two jobs. It catches the rare real fraud early enough to stop the payment. And it defends the board's diligence on the ninety-nine transactions that were clean, because you can show exactly what was verified, when, and by whom on every dollar that left the reserve account.
This matters for D&O coverage and for owner trust. A board that can produce a timestamped verification history for every reserve disbursement is a board that exercised reasonable diligence, whether or not fraud was ever attempted. That is the difference between a defensible loss and a negligence claim.
“The fraud you catch justifies the system once. The audit trail you build justifies it every single day, because it is the thing that proves the board did its job when nobody thought anything was wrong.”
Todd Paton, Partner, One Home Agent
Where the agent stops and a human signs
A screening agent flags, verifies, and documents. It does not release funds and it does not accuse anyone. The final call to pay, hold, or investigate belongs to the manager and, above a threshold, the board. That boundary is the point, not a limitation.
This keeps the human judgment where it belongs. A round-number invoice from a fifteen-year vendor after a legitimate scope change is not fraud, and a person who knows the relationship can clear it in a sentence. The agent's job is to make sure that sentence gets written down and that nobody skips the check when they are underwater in December.
Done right, the agent absorbs the tedious cross-referencing that humans quietly stop doing when they are busy, which is precisely when fraud slips through. The manager keeps the relationships and the decision. The record keeps the board protected.
Bottom line
Shell-company vendor fraud targets reserves because reserves are big, infrequent, and rarely reviewed. You cannot prevent every attempt, but you can make your association a hard target and a defensible board by screening every disbursement continuously and documenting it. The paper trail is what catches the fraud and defends the diligence.
Build the vendor paper trail before the next reserve draw
We build custom AI operations agents trained on your communities, including vendor screening and COI tracking that flags anomalies before payment leaves the account. The first agent is free, and your company keeps it.
See how it works for your portfolioFrequently asked questions
A shell-company vendor is a business that exists mainly on paper, created to receive payments without delivering the full service billed. In HOA fraud, someone sets up an LLC and bank account, submits plausible invoices for reserve-funded work, and pockets the difference between what was billed and what was actually done.
Sources & further reading