The 21st Minute


CaseWare IDEA Used to Take Down Cartel Oil Thieves

Data Analytics used to Identify and Prove $1.5 Million Oil Theft

The vast expanse of the Eagle Ford Shale oilfield has provided ample opportunities for drug and oil cartels who have exploited the area’s network of private roads since 2012. The Texas Attorney General’s Office is investigating several cases of oil theft, totaling tens of millions in losses for oil companies who continue to struggle as barrel prices decrease in value.



  • Cartel thieves stole $1.5 million in Eagle Ford Shale oil
  • Data analytics results provided to federal and state government to prosecute thieves
  • IDEA used to process several million tank level measurements in seconds

In the sweltering South Texas heat, Eagle Ford Shale oilfield crew noticed some truck drivers wearing hardhats inside their air conditioned trucks to conceal their faces. Workers also noticed valves were unsealed or unlocked, and release valves were not used properly. These tips were shared with lease operators including Newfield Exploration and Anadarko Petroleum Corporation. A taskforce was assembled to conduct a complete investigation involving the well operators, federal and state authorities, and auditors at EXCO Resources, Inc.

Between January 2011 and August 2014, trucks that were dispatched to remove wastewater from well sites were instead siphoning oil illegally. The pilfered oil was transported to another location where it was sold for financial gain to third-party buyers who paid via wire transfer. In order to prosecute the offenders, authorities needed proof of the thefts, including how many barrels were stolen and how much each was worth.


The audit team with EXCO Resources was tasked with analyzing large amounts of data from different sources, and law enforcement officials were anxious to identify discrepancies from data. Al Phillips, an internal audit manager with EXCO Resources, stepped forward to assist with the investigation.

The task force agreed to investigate 200 wells sites with about five tanks per site. Each truck removing crude oil from a field storage tank received a run ticket, which includes data such as the well and meter names, tank levels, dates/times, etc. An average truck can hold approximately 170 barrels of oil, which lowers the tank level about 100 inches per load. Well production is tracked by the hour, which ensures high levels of accuracy about each field tank.

“The producing companies deal in such high volumes, that someone who takes a hundred gallons here or there may go unnoticed unless your paperwork is perfect. It’s nearly impossible to detect without technology.”
Al Phillips, Auditor & Data Analytics Expert

Phillips, an experienced data analytics user, obtained run tickets and used CaseWare IDEA® to compare tickets against 15-inch, hourly drops in the tank levels. Because production information and sales records were created and stored in completely different systems, multiple join techniques were required. 

Sales references by tank numbers had to be cross-referenced and joined with well names corresponding to the specific well sites for all run tickets. Then these expanded sales records had to be joined/compared to summarized tank level drops for each of the wells.  Storage tank drops/losses without matching run ticket records were then analyzed by time and date stamp, gapped, and grouped.

Phillips used IDEA to process several million tank level measurements spanning nine months in just seconds, and then refined the anomalies to a manageable number and discovered numerous instances of tank withdraws that did not have corresponding run tickets. He produced concise, descriptive spreadsheets that could be easily shared with authorities.


Analysis provided sound evidence that run tickets were missing and trucks were “piggy backing” to remove crude oil illegally from over 100 wells. Upon further investigation, results uncovered a sophisticated fraud where thieves used Google Earth to find active wells, counterfeited trucks to steal thousands of barrels of crude oil, worth approximately $20,000 per load. Profits from the fraud were funneled through an elaborate money laundering scheme.

Results were shared with the army of local, state and federal officials involved in the investigation including the FBI, IRS Service Criminal Investigation, Texas Attorney General’s Special Investigations Unit, the Bexar County District Attorney’s Office, Texas DPS, Texas Rangers, local Sheriff’s Office and the Texas Railroad Commission. Charges included theft of oil from an interstate shipment, wire fraud and money laundering. The indictment included a notice of criminal forfeiture where the government is seeking proceeds derived from the fraud scheme, as well as funds totaling more than $1.5 million, which represents the amount of proceeds obtained, directly or indirectly, as a result of the criminal scheme.

Oil field thefts are expected to increase as prices drop and desperate men join the unemployment lines. To prevent further theft attempts, fraud hotspots are regularly monitored, alarms have been added to the tanks to track significant or abnormal volume drops, and detailed reports are provided to well owners each month.

“Law enforcement agencies collaborated to narrow in on the illegal transporters. IDEA was instrumental in analyzing considerable amounts of data quickly to provide evidence used to convict the fraudsters. Our collaboration and the creative use of data analytics had a lasting financial impact.”
Al Phillips

CaseWare IDEA , Success Story

Posted By


Related Posts
Wayfair Woes One Year Later
Jul 24 The rise in online shopping has sharply impacted state sales tax revenue. Rather than increasing the tax rate, states are setting parameters to define nexus, wh...
Importing Date Fields
Jul 24 There are times when you import a date field and it just does not work out as expected. Here are ways to address the problem before or after the import.  ...
Tech Tip: Understanding Join and Visual Connector
Jun 19 Using IDEA’s Join and Visual Connector features can help you search for matches and correlations between different data sets, but they are often confused with...

This website has been designed for modern browsers. Please update. Update my browser now