8 Startup Financial Red Flags, Sorted by What They Predict

HeadSpin told its Series C investors that its annual recurring revenue at the end of 2019 was about $80 million, and they valued it at $1.1 billion. According to the SEC, the figure was closer to $10 million, kept by the chief executive in an “ARR-tracking Spreadsheet that he alone controlled”. A screen for startup financial red flags would not have caught it.

The SEC’s complaint describes how the number stayed out of reach (SEC v. Lachwani, complaint). Manish Lachwani sent revenue figures to the bookkeeper without the contracts and invoices she regularly asked for, and “rebuffed repeated requests from late 2017 into 2020 from HeadSpin’s board to hire a CFO”. The spreadsheet credited a reseller with more than $10 million of ARR; the reseller had paid about $1.4 million over 2018 and 2019, so one year of claimed ARR was more than 7 times two years of payments. Fake invoices covered other gaps. After an internal investigation, HeadSpin cut its valuation to about $300 million and returned about 70% of principal to its Series B and C investors.

Rapid growth, operating losses and repeated fundraising, all fraud risk factors in the auditors’ standard, describe almost every venture-backed company. What set HeadSpin apart was narrower: a headline number no outsider could reproduce, supported by evidence that reached investors only through the founder. Five other SEC cases against startups share that shape.

Exhibit 1. Startup financial red flags, sorted by whether they separate fraud from ordinary startup life

Red flag	Fires on honest startups?	Seen in the SEC cases (Exhibit 2)	What settles it
Rapid revenue growth	Almost always	Not distinctive	Nothing: it is a precondition, not evidence
Recurring negative operating cash flow	Almost always before profitability	Not distinctive	Nothing
Raising new money	At every round	Five of six raised; Frank was sold	Nothing
One founder controls sales and the numbers	Often, at seed	HeadSpin; IRL had no CFO until after its round	Who books revenue, and who else sees the source records
ARR or revenue running ahead of cash collected, customer by customer	Rarely, beyond timing	HeadSpin	Payments received per customer, from bank records
A headline metric no outsider can reproduce	Rarely	All six	The customers, users or bank, contacted directly
Evidence that reaches the investor only through the company	Rarely	Frank, Joonko, Kubient	A confirmation sent and received directly
Payments routed through intermediaries; personal spending on company cards	Rarely	IRL	The vendors’ own invoices; card statements

Source: AICPA, AU-C 240, appendix A (rows 1 to 4, 7 and 8 appear among its example fraud risk factors); SEC complaints and releases listed under References. The second column is CX Cash’s judgement rather than a measured rate.

The textbook startup financial red flags describe almost every startup

AU-C 240, the AICPA’s section on fraud in an audit, governs audits of private companies (AICPA, 2026). Its appendix lists rapid growth, recurring negative cash flow from operations and the need to raise new debt or equity among its example fraud risk factors (AICPA, AU-C 240). A seed-stage software company meets all three by design. The opportunities it lists include “Domination of management by a single person or small group (in a nonowner-managed business) without compensating controls”, and the standard concedes that domination by one person in a small entity “does not generally, in and of itself, indicate a failure”.

The research on detecting manipulation treats growth the same way. Messod Beneish estimated his M-score on 74 companies that manipulated earnings and 2,332 that did not, drawn from Compustat for 1982 to 1992. The manipulators’ median sales growth was 34.4%, against 9.4% for the controls. Beneish explained why growth enters the model: “Growth does not imply manipulation, but growth firms are viewed by professionals as more likely to commit financial statement fraud because their financial position and capital needs put pressure on managers to achieve earnings targets” (Beneish, 1999). A company scoring above −1.78 is classed as a likely manipulator.

Applied to a startup, a use Beneish never intended, the score misfires. Consider a company whose other ratios are unchanged from last year and whose earnings equal its operating cash flow. At flat revenue it scores −2.48. It crosses the line at revenue growth of about 78% a year, and a company that triples its revenue scores about −0.70 (our arithmetic). The checklist costs time as well: venture investors surveyed by Paul Gompers and co-authors reported an average of 118 hours of due diligence per deal, spread over 83 days, with 10 references called (Gompers et al., 2020).

A flag that fires on every company carries no information

Medical screening has the vocabulary for this. A test in use is judged by its positive predictive value, the share of positive results that are true. Such values “are not intrinsic to the test (as true positive rate and true negative rate are); they depend also on the prevalence” (Wikipedia, Positive and negative predictive values).

PPV = sensitivity × prevalence ÷ [sensitivity × prevalence + false-positive rate × (1 − prevalence)]

A flag present in every company, honest or not, has a sensitivity and a false-positive rate of 100%, so its predictive value equals the prevalence of fraud. The investor ends exactly where the investor started.

Purpose-built models do better, though by less than their reputations suggest. At an F-score above 1.00, the model that Patricia Dechow and three co-authors built from SEC enforcement releases flagged 328 of 498 misstating firms, and also 50,185 of 143,490 firms with no enforcement action against them (Dechow et al., 2011). Of all the firms it flagged, 0.65% had a detected misstatement, about 1 in 154. The authors say so: “our models generate a high frequency of false positives”. In Beneish’s holdout sample, the −1.78 cut-off missed 50% of manipulators and flagged 7.2% of the others.

Detected fraud understates the base rate, which helps the screens, though not by enough. Alexander Dyck, Adair Morse and Luigi Zingales estimate that “in normal times only one-third of corporate frauds are detected”. They put the share of large publicly traded firms committing securities fraud in a given year at 10%, with a 95% confidence interval of 7% to 14% (Dyck, Morse & Zingales, 2023). If Dechow’s flagged firms held three times as many true cases as were detected, fewer than 2 flags in 100 would still be right. At a 10% prevalence, Beneish’s holdout error rates give a predictive value of about 44% (our arithmetic), so most flagged companies would still be honest. That illustration mixes two samples of public companies, and nobody has measured the prevalence of fraud among private startups.

In medicine, a positive screen goes to a confirmatory test. In diligence, it usually goes to a conversation with the founder, the one person whose numbers are in question. Diligence differs from medicine in exactly that respect: a patient cannot forge the specimen, and a founder can.

Five more SEC startup cases follow HeadSpin’s pattern

Exhibit 2. Six SEC fraud cases against startups: the number claimed and the number found

Company (SEC action)	Metric investors priced	Claimed	Found, per the SEC	Money involved	Evidence investors were given
Theranos (2018)	2014 revenue	More than $100M (projection)	A little more than $100,000	More than $700M raised	Investor presentations and product demonstrations
HeadSpin (2021)	Annual recurring revenue, end of 2019	About $80M	Closer to $10M	About $80M raised; valuation over $1B	An ARR spreadsheet the CEO alone controlled; fake invoices
Frank (2023)	Student users	4.25M	Fewer than 300,000	$175M sale to JPMorgan Chase	A synthetic list, checked for blank fields
IRL (2024)	Users, said to be organic	12M	95% of users with usage data likely bots	About $170M raised	Offering documents that understated marketing spend
Joonko (2024)	2021 ARR	$2.2M	No more than $100,000	At least $21M raised	Forged bank statements and contracts; references who were not customers
Kubient (2024, pre-IPO revenue)	Revenue from fraud-detection tests	$1.3M, about 95% of revenue at the IPO	Tests never performed	$12.5M IPO and $20.7M follow-on	Test reports created by the CEO and edited by the CFO

Source: SEC press releases 2018-41, 2021-164, 2023-74, 2024-70, 2024-92 and 2024-131, and the complaints cited below. Figures are the SEC’s allegations. HeadSpin’s $80M of ARR was the year-end figure given to Series C investors.

Across the six cases, more than $1.1 billion was raised or paid, and in none of them was the false number a ratio. It was a count that set the price: dollars of ARR, users, customers, revenue from a named contract. Ratios could look normal, and IRL is the clearest case. Its 2021 board reports showed about $4.2 million of growth spending and about $13.5 million of infrastructure; according to the SEC, the true figures were more than $14.2 million and about $3.4 million (SEC v. Shafi, complaint). The reported total of $17.7 million was within $0.1 million of the true one, so burn, runway and every ratio built on total spending came out right. Only the split was false, and the split hid the paid advertising behind the growth.

Beyond HeadSpin, the cases share the same control over the evidence. IRL’s Series C closed in four tranches between 18 May and 17 June 2021, and the company hired its first CFO that August. Joonko’s board grew suspicious when the CFO “refused to show Board members certain documents” (SEC v. Raz, complaint). At Kubient, the CFO saw that the test reports did not match the invoices and, with the CEO’s assent, edited the reports to match before the auditor saw them (SEC v. Roberts, complaint). These are AU-C 240’s opportunity factors, and unlike growth, they do not describe every startup.

Confirmation counts only when the record comes straight from its source

Synthetic customers are older than synthetic data. In 1973 Equity Funding was found to have created more than 60,000 bogus life insurance policies, kept on a computer system built for fictitious policies (Wikipedia, Equity Funding). Told of it by a former officer, the Wall Street Journal’s Los Angeles bureau chief “did not believe, however, that such a massive fraud could go undetected”. The fraud was confirmed when California insurance authorities impounded the company’s records, and “Only then did the Securities and Exchange Commission (SEC) file a complaint against Equity Funding” (Dirks v. SEC, 1983).

Auditing rules now build that lesson in. The PCAOB’s confirmation standard, which applies to audits of public companies for fiscal years ending on or after 15 June 2025, states: “The auditor should send the confirmation request directly to the confirming party and obtain the confirmation response directly from the confirming party” (PCAOB, AS 2310).

JPMorgan Chase applied half of that rule when it bought Frank. Asked for the customer list, Javice cited privacy, JPMorgan insisted, and the two sides agreed on a third-party validator. The validator received its file from Frank, which had paid a data science professor $13,300 to manufacture it, and reported that 100% of 4,265,085 entries had a first name, last name, email address and phone number (SEC v. Javice, complaint). It confirmed, in other words, that the cells were not empty. The test that mattered came after closing, on lists Frank had bought from data compilers: of 400,000 marketing emails, 28% were delivered and 1.1% of those were opened, about 1,232 people. At Joonko, a bank statement passed along by the company showed $3.7 million in an account holding under $1 million.

The rule for an investor follows: a headline number counts as confirmed only when it reconciles to a record produced by someone the company does not control, delivered without passing through the company. Exhibit 3 names such a source for each common headline number.

Exhibit 3. An outside source for each headline number

Headline number	Outside source	What to obtain directly	Case it would have caught
Cash balance	The bank	A confirmation sent and returned by the investor’s accountant, or read-only access	Joonko’s $3.7M statement
ARR and revenue	Customers’ payments	Cash received per customer from bank records, matched to the ARR list	HeadSpin
Customer count	The customers	Calls to a sample the investor picks from the contract list	Joonko: over 100 claimed, about 30 real
Users	The users	A small outbound test to a random sample before closing	Frank
Marketing spend and CAC	The ad platforms	The platforms’ own invoices rather than an agency’s	IRL
Product performance	Independent use	A test run on inputs the investor chooses	Theranos; Kubient

Source: CX Cash synthesis of the cases in Exhibit 2; the direct-confirmation principle is from PCAOB AS 2310.

Failing an outside source, the next best evidence is a pair of numbers that should move together. Beneish’s two largest coefficients sit on such pairs: 0.920 on receivables growing faster than sales, and 4.679 on total accruals, earnings minus operating cash flow, scaled by total assets (Wikipedia, Beneish M-score). For a startup the pair is ARR against cash collected, customer by customer, the comparison that would have shown HeadSpin’s reseller paying a seventh of what the spreadsheet claimed.

When Joonko’s founder was confronted about the forged documents, she admitted that the customer count, the revenue and the bank balances were false as well. The old rule of evidence would have predicted it: falsus in uno, falsus in omnibus, false in one thing, false in everything. Judge Richard Posner called the maxim a “discredited doctrine”. The same opinion drew the line that matters: “the mistakes that witnesses make in all innocence must be distinguished from slips that, whether or not they go to the core of the witness’s testimony, show that the witness is a liar” (Wikipedia, Falsus in uno). A loosely defined metric belongs to the first kind; an edited invoice belongs to the second.

If insiders catch most frauds, what is diligence for?

Dyck, Morse and Zingales studied 230 frauds at companies with more than $750 million of assets between 1996 and 2004. “Only 6% of the frauds are revealed by the SEC and 14% by the auditors”; financial analysts revealed 15%, short sellers 1% and employees 19% (Dyck, Morse & Zingales, 2007). The study covers large companies, but the startup cases point the same way. HeadSpin’s board was alerted in March 2020, well after its Series B; IRL’s user count collapsed after a special committee removed the founder over personal spending on company cards; Frank’s list failed a marketing test after the deal closed. In none of the six did investors’ diligence stop the money before it moved.

On this evidence, reading the financial statements finds little, and in these cases it found nothing: a forger who controls the evidence passes the ratio checks, as IRL’s totals did. Yet in four of the six cases the decisive record existed before closing and sat outside the company: the customers’ payments at HeadSpin, the students at Frank, the bank at Joonko, the ad platforms at IRL. The whistle-blowing data argue for asking those sources directly, and for insiders placed to notice. In these files the insiders were finance staff, HeadSpin’s bookkeeper and Joonko’s CFO, and a company with no finance function independent of its founder has fewer people in that position.

Records to line up before the round closes

Before the data room opens

• Reconcile ARR to cash received, customer by customer, every month, and put the reconciliation in the data room.
• Offer outside records before anyone asks: read-only access to bank and billing accounts, and bank confirmations sent straight to the investor’s accountant.
• Give the board a finance lead who does not report only to the founder. HeadSpin’s board asked for a CFO for more than two years.

Before the money moves

• Sort the checklist by how often each flag fires on honest companies, and stop scoring growth, losses and fundraising as red.
• For each number the price depends on, name its outside source and obtain the record directly from it.
• Pick reference customers from the contract list yourself; Joonko’s founder supplied references who were not customers.
• After one forged record, recheck everything else, and add an outside-source column to the financial due-diligence checklist below.

Most startup financial red flags describe a startup, so a positive result tells an investor little. The SEC’s startup cases point to a narrower test: a headline number nobody outside the company could reproduce, supported by evidence that came only through the founder. Six cases are a thin base, selected by the SEC’s decision to sue, so they show how these frauds were hidden and say nothing about how common fraud is among private startups.

Ratios screen; sources confirm.

References

• AICPA (2021). AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, including appendix A, Examples of Fraud Risk Factors.
• AICPA & CIMA (2026). AICPA Statements on Auditing Standards, currently effective.
• Beneish, M. D. (1999). The detection of earnings manipulation. Financial Analysts Journal 55(5), 24–36.
• Dechow, P. M., Ge, W., Larson, C. R. and Sloan, R. G. (2011). Predicting material accounting misstatements. Contemporary Accounting Research 28(1), 17–82.
• Dirks v. Securities and Exchange Commission, 463 U.S. 646 (1983).
• Dyck, A., Morse, A. and Zingales, L. (2007). Who blows the whistle on corporate fraud? NBER Working Paper 12882; published in the Journal of Finance (2010).
• Dyck, A., Morse, A. and Zingales, L. (2023). How pervasive is corporate fraud? Review of Accounting Studies 29(1), 736–769.
• Gompers, P., Gornall, W., Kaplan, S. N. and Strebulaev, I. A. (2020). How do venture capitalists make decisions? Journal of Financial Economics 135(1), 169–190; NBER Working Paper 22587.
• PCAOB. AS 2310, The Auditor’s Use of Confirmation (Release No. 2023-008), and AS 2401, Consideration of Fraud in a Financial Statement Audit.
• SEC (2018). Press Release 2018-41, Theranos, CEO Holmes, and Former President Balwani Charged With Massive Fraud, 14 March.
• SEC (2021). Press Release 2021-164 and complaint, SEC v. Manish Lachwani, N.D. Cal. No. 5:21-cv-06554, 25 August.
• SEC (2023). Press Release 2023-74 and complaint, SEC v. Charlie Javice, S.D.N.Y. No. 1:23-cv-02795, 4 April.
• SEC (2024). Press Release 2024-70 and complaint, SEC v. Ilit Raz, S.D.N.Y. No. 1:24-cv-04466, 11 June.
• SEC (2024). Press Release 2024-92 and complaint, SEC v. Abraham Shafi, N.D. Cal. No. 4:24-cv-04636, 31 July.
• SEC (2024). Press Release 2024-131 and complaint, SEC v. Paul D. Roberts, S.D.N.Y. No. 1:24-cv-06990, 16 September.
• Wikipedia. Beneish M-score; Equity Funding Corporation of America; Falsus in uno, falsus in omnibus; Positive and negative predictive values.

SEC facts are the Commission’s allegations, as set out in its press releases and complaints. Quotations from Beneish (1999) and Dechow et al. (2011) follow their working-paper versions, and Judge Posner’s words are quoted as Wikipedia gives them, from Kadia v. Gonzales (7th Cir. 2007). Ratios, totals and counts given without a source are calculated from the cited cases and papers: the M-score cases assume every other ratio unchanged and earnings equal to operating cash flow, and the 44% predictive value applies Beneish’s error rates to Dyck, Morse and Zingales’s prevalence estimate as an illustration. Exhibits 1 and 3 are CX Cash syntheses.