Fraud Friday: Employee Uses 12 PayPal Working Capital Loans to Hide $4 Million Theft

October 16, 2026

Bob Coleman
Founder & Publisher

Fraud Friday: Employee Uses 12 PayPal Working Capital Loans to Hide $4 Million Theft

Back in the day, before online banking, bankers advised their small-business customers to have monthly checking account statements delivered to their homes. Open the envelope, verify that the paper checks were properly signed, and then turn the statement over to the bookkeeper.

That added layer of scrutiny was meant to protect the business from the longtime, trusted employee who knew how to cover their tracks. The world has changed with online banking.

For the bank manager handling GPP’s commercial accounts, questions about cash flow became an almost daily conversation. His customer, a Florida company selling promotional and advertising products, had maintained a healthy balance with no history of cash-flow problems. 

Until March 2022, when GPP’s checking account began being overdrawn almost daily.

The banker began receiving panicked early-morning phone calls from the Director of Operations, Colleen Kieran.

In addition to her financial responsibilities, Kieran had been entrusted with signing authority over the business bank account.

She appeared stressed and anxious recalled the banker about the overdrafts.  There was always an explanation, but the explanations kept changing.

• The mail was late. Kieran said the company’s mail arrived late each day at its post office box, delaying her retrieval of vendor checks she needed to deposit.
• The paperwork had to come first. She said she had to reconcile incoming invoices before preparing deposits, making it difficult to meet deposit deadlines.
• The deposit machine was broken. The bank had supplied a remote deposit capture machine so the company could deposit checks after banking hours. Kieran insisted it was not working.
• The replacements were no better. The banker ordered replacement machines. Kieran alternated between saying they had never arrived, couldn’t be set up, or didn’t function. But the banker noticed remote deposits were being made on the “malfunctioning” equipment.

Then there were her personal checks. Kieran deposited checks from her own account into the business account. And those checks began bouncing.

After months of shortages, daily emergency deposit requests, changing stories about the mail and equipment, and the pattern of returned personal checks, the banker contacted GPP management. 

The company president confronted Kieran. At first, she denied knowing what the banker was talking about. When pressed for an explanation, she became emotional and said she was putting her own money into the business to cover temporary shortages and ensure payroll and vendor payments cleared.

She also claimed she had lost online access to the business bank account months earlier and showed the president an unsuccessful login attempt. She denied stealing.

Management checked her explanations with the banker, who told them they didn’t match the bank’s records. She had continued accessing the account online despite claiming otherwise. They removed her access to the business bank accounts but did not fire her. 

They believed she was a devoted employee who was “just bad at her job” and had been given too much responsibility.

A forensic accountant spent two months investigating the shortages. The investigation led to the company’s PayPal account, which Kieran alone could access. She would not cooperate in giving management access. Company leaders spent nightmarish hours on the phone. It took days of direct correspondence with PayPal to get into their own account. 

Customer credit card payments went into the company’s PayPal account before the company swept them into its bank account. 

But Kieran diverted payments to her personal PayPal account before the sweep. 

Since 2009.

She started small at $500 a pop until the fraud escalated to $1,000 every few days. 

The final tally? $3,955,857.91.

Kieran used the stolen money for personal expenses, including clothing, travel, dining, entertainment, and consumer electronics. 

To conceal her fraud and the growing financial loss to the company, Kieran prepared false financial statements and spreadsheets and withheld information from the company’s owners and tax preparer. When the missing money became harder to conceal, she turned to borrowing. Between February 2020 and April 2022, Kieran obtained more than $1.5 million through 12 PayPal working capital loans in the company’s name without the owner’s knowledge.

Several were timed to arrive before payroll, vendor payments, owner distributions, taxes or credit card payments came due. Repayments came out of future customer credit card receipts.

After the fraud was uncovered and Kieran was fired, her employers discovered she had also been intercepting the company’s incoming mail and had selectively deleted several years’ worth of emails from her company account.

Federal prosecutors announced October 8 that Kieran, 57, had pleaded guilty to three counts of wire fraud. 

To rescue the business, the owner put his own money into GPP to cover its bills. 

He sold personal stocks and real estate and contributed more than $700,000 to pay vendors and employees.