INTEGRITY  EFFICIENCY  ACCOUNTABILITY  EXCELLENCE

Inspector General 

U.S. Department of Defense

MAY 19, 2015

DoD Cardholders Used Their 

Government Travel Cards for 

Personal Use at Casinos and Adult 

Entertainment Establishments

Report No. DODIG-2015-125
Mission

Our mission is to provide independent, relevant, and timely oversight 

of the Department of Defense that supports the warfighter; promotes 

accountability, integrity, and efficiency; advises the Secretary of 

Defense and Congress; and informs the public.

Vision

Our vision is to be a model oversight organization in the Federal 

Government by leading change, speaking truth, and promoting 

excellence—a diverse organization, working together as one 

professional team, recognized as leaders in our field.

For more information about whistleblower protection, please see the inside back cover.

INTEGRITY  EFFICIENCY  ACCOUNTABILITY  EXCELLENCE

dodig.mil/hotline|800.424.9098

HOTLINE

Department of Defense

Fraud, Waste & Abuse
DODIG-2015-125 (Project No. D2014-D000CL-0201.000) │ i

Results in Brief

DoD Cardholders Used Their Government Travel 

Cards for Personal Use at Casinos and Adult 

Entertainment Establishments

Visit us at www.dodig.mil

Objective

Our objective was to determine whether 

DoD Government travel charge card holders 

used their card for personal use at casinos 

or adult entertainment establishments. 

Public Law 112-194, “Government Charge 

Card Abuse Prevention Act of 2012,” 

requires the Inspector General of each 

executive agency with more than $10 million 

in travel card spending to periodically 

audit or review travel card programs. We 

focused on individually billed travel cards. 

Cardholders are personally and financially 

liable for payment of all undisputed charges, 

including personal use, indicated on the 

billing statement, not the government.

Finding 

DoD cardholders improperly used their 

Government travel charge card (GTCC) 

for personal use at casinos and adult 

entertainment establishments. From 

July 1, 2013, through June 30, 2014, 

DoD cardholders had 4,437 transactions 

totaling $952,258, where they likely used 

their travel cards at casinos for personal 

use and had 900 additional transactions 

for $96,576 at adult entertainment 

establishments. Specifically, we reviewed 

seven nonstatistically selected cardholders 

who had 76 transactions valued 

at $19,643 to confirm that our analysis 

identified personal use at casinos and 

adult entertainment establishments from 

July 1, 2013, to June 30, 2014. DoD did not 

detect these transactions because:

• the Defense Travel Management Office 

(DTMO) compliance program did not 

assist Agency Program Coordinators 

to identify personal use at casino and 

adult entertainment establishments; 

May 19, 2015

• DoD policy did not specifically identify high‐risk 

merchants or categories for personal use such as in 

casinos or adult entertainment establishments; and

• Citibank was not required to notify Agency Program 

Coordinators or management officials of potential 

fraudulent activity or suspension of accounts. 

As a result, Component Program Managers and Agency 

Program Coordinators did not have sufficient details on 

transactions that occurred at casinos or adult entertainment 

establishments to determine if there was misuse. Unless 

DTMO and the Component Program Managers improve 

oversight actions, improve internal controls of the 

GTCC program, and provide written prohibition of the use of 

the GTCC at high-risk merchants, DoD personnel may continue 

to use their GTCCs for personal use at casinos and adult 

entertainment establishments. Finally, without these controls 

in place the Department will not be able to identify and hold 

personnel accountable for misuse of the GTCC.

Recommendations

We made several recommendations to address these problems. 

See the recommendations sections of the finding in the report. 

Management Comments 

and Our Response

Comments from the Director, Defense Travel Management 

Office addressed recommendations 1.e; partially addressed 

1.a, 1.b, 1.c, and 1.d.2; and did not address the specifics 

of 1.d.1. Comments from the Service Component Program 

Managers partially addressed recommendations 2‐5. We 

request comments in response to the recommendations by 

June 30, 2015. Please see the Recommendations Table on the 

back of this page.

Finding (cont’d)
ii │ DODIG-2015-125 (Project No. D2014-D000CL-0201.000) 

Recommendations Table

Management Recommendations 

Requiring Comment

No Additional 

Comments Required

Director, Defense Travel Management Office 1.a, 1.b, 1.c, and 1.d 1.e

Army Component Program Manager 2

Navy Component Program Manager 3

Air Force Component Program Manager 4

U.S. Marine Corps Component Program Manager 5

Please provide Management Comments by June 30, 2015 
DODIG-2015-125 │ iii

May 19, 2015

MEMORANDUM FOR DISTRIBUTION 

SUBJECT: DoD Cardholders Used Their Government Travel Cards for Personal Use at Casinos 

and Adult Entertainment Establishments (Report No. DODIG-2015-125)

We are providing this report for your review and comment. We considered management 

comments on a draft of this report when preparing the final report. DoD cardholders 

improperly used their Government Travel Charge Card for personal use at casinos and adult 

entertainment establishments. From July 1, 2013, through June 30, 2014, DoD cardholders 

had 4,437 transactions totaling $952,258, where they likely used their travel cards at casinos 

for personal use and had 900 additional transactions for $96,576 at adult entertainment 

establishments. We conducted this audit in accordance with generally accepted government 

auditing standards.

DoD Instruction 7650.03 requires that recommendations be resolved promptly. Comments 

from the Director, Defense Travel Management Office addressed Recommendation 1.e and 

partially addressed Recommendations 1.a, 1.b, 1.c, and 1.d. Therefore, we request comments 

on Recommendations 1.a, 1.b, 1.c, and 1.d. Comments from the Deputy Assistant Secretary 

of the Army, Financial Operations, responding for the Army Component Program Manager, 

partially addressed Recommendation 2. Therefore, we request additional comments on 

Recommendation 2. Although the Navy, Air Force, and Marine Corps Component Program 

Managers did not provide a memorandum, each Service provided comments in a spreadsheet 

that partially addressed Recommendations 3, 4, and 5. Therefore, we request additional 

comments on Recommendations 3, 4, and 5. We request all comments be received 

by June 30, 2015.

Please send a PDF file containing your comments to aud-colu@dodig.mil. Copies of your 

comments must have the actual signature of the authorizing official for your organization. 

We cannot accept the /Signed/ symbol in place of the actual signature. If you arrange to send 

classified comments electronically, you must send them over the SECRET Internet Protocol 

Router Network (SIPRNET). 

We appreciate the courtesies extended to the staff. Please direct questions to me at 

(703) 604‐9187 (DSN 664-9187). 

Michael J. Roark

Assistant Inspector General

Contract Management and Payments

INSPECTOR GENERAL

DEPARTMENT OF DEFENSE

4800 MARK CENTER DRIVE

ALEXANDRIA, VIRGINIA 22350-1500
iv │ DODIG-2015-125 

Distribution:

UNDER SECRETARY OF DEFENSE FOR PERSONNEL AND READINESS

ASSISTANT SECRETARY OF THE AIR FORCE (FINANCIAL MANAGEMENT AND COMPTROLLER)

DIRECTOR, DEFENSE CONTRACT MANAGEMENT AGENCY

DIRECTOR, DEFENSE LOGISTICS AGENCY

DIRECTOR, DEFENSE THREAT REDUCTION AGENCY 

DIRECTOR, DEFENSE TRAVEL MANAGEMENT OFFICE 

NAVAL INSPECTOR GENERAL

AUDITOR GENERAL, DEPARTMENT OF THE ARMY
DODIG-2015-125 │ v

Contents

Introduction

Objective ________________________________________________________________________________________1

Background_____________________________________________________________________________________1

Review of Internal Controls ___________________________________________________________________4

Finding. DoD Government Travel Charge Cards 

Were Used at Casinos and Adult Entertainment 

Establishments________________________________________________________________________5

DoD Cardholders’ Personal Use of the Government Travel Charge Card _________________6

Improvements Needed for Detection of Personal Use ______________________________________7

Use of the Government Travel Charge Card While Not in Travel Status Could 

Indicate Personal Use__________________________________________________________________8

Cash Withdrawals That Exceed Meal and Incidental Expenses While in Travel 

Status Could Indicate Personal Use __________________________________________________9

Using Merchant Names Could Assist Agency Program Coordinators to Identify 

Potential Personal Use_______________________________________________________________ 11

Multiple Declined Authorizations Could Indicate Personal Use ___________________ 12

Government Travel Charge Card Activity Outside of Official Travel Location 

Could Indicate Personal Use ________________________________________________________ 14

Defense Travel Management Office Needs to Update the DoD Financial Management 

Regulation___________________________________________________________________________________ 15

Prohibit High-Risk Merchants ________________________________________________________ 15

Require Review of Declined Authorizations Report________________________________ 16

Provide APCs Access to Visa IntelliLink and Require Its Use _____________________ 16

Citibank Not Required to Notify the Agency Program Coordinator of Fraudulent 

Activity or Suspension of Travel Cards ___________________________________________________ 16

Management Actions_________________________________________________________________________ 18

Conclusion ____________________________________________________________________________________ 19

Management Comments on the Finding and Our Response ______________________________ 19

Recommendations, Management Comments, and Our Response ________________________ 20
vi │ DODIG-2015-125 

Appendix

Scope and Methodology _____________________________________________________________________ 28

Use of Computer-Processed Data ___________________________________________________________ 30

Use of Technical Assistance _________________________________________________________________ 31

Prior Coverage _______________________________________________________________________________ 31

Management Comments

Director, Defense Travel Management Office ______________________________________________ 32

Deputy Assistant Secretary of the Army (Financial Operations)________________________ 37

Acronyms and Abbreviations_____________________________________________ 38

Contents (cont’d)
Introduction

DODIG-2015-125 │ 1

Introduction

Objective

We determined whether DoD Government travel charge card holders used their 

cards for personal use at casinos or adult entertainment establishments. We 

focused on individually billed travel cards. Cardholders are personally and 

financially liable for payment of all undisputed charges, including personal use, 

indicated on the billing statement, not the government. See Appendix for the scope 

and methodology related to our audit objective. 

Audit Requirement in Public Law 112-194 “Government Charge 

Card Abuse Prevention Act of 2012”

Public Law 112-1941 requires the Inspector General of each executive agency with 

more than $10 million in travel card spending to periodically audit or review travel 

card programs to analyze risks of illegal, improper, or erroneous purchases and 

payments. The findings of such audits or reviews, along with recommendations to 

prevent improper use of travel cards, are reported to the Director of the Office of 

Management and Budget and to Congress.

Background

General Services Administration 

The General Services Administration (GSA) is responsible for issuing 

Government‐wide travel card policies and procedures for implementing the 

Travel and Transportation Reform Act of 1998. GSA awards and administers a 

master contract for the travel card program. On behalf of DoD, GSA placed a task 

order with Citibank on the master contract effective January 2008. In 2011, DoD 

exercised the first option period and extended the contract with Citibank from 

November 29, 2011, through November 29, 2015. 

DoD Travel Card Program 

The DoD Government Travel Charge Card (GTCC) Program provides travelers 

with an effective, convenient, and commercially available way to pay for expenses 

related to official travel. The GTCC is the primary payment method for official 

travel expenses incurred by DoD personnel, is mandatory for all DoD personnel 

who have been issued a travel card, and is for official travel‐related use only. 

1 Public Law 112-194, “Government Charge Card Abuse Prevention Act of 2012,” October 5, 2012.
Introduction

2 │ DODIG-2015-125

Official Government travel is defined as travel under official orders while 

performing duties pertaining to official Government assignments such as 

temporary duty and permanent change of station. In most instances, duties 

pertaining to official Government assignments would occur in the official 

travel location. 

From July 1, 2013, through June 30, 2014, DoD cardholders used their individually 

billed cards to make approximately 20 million transactions totaling $3.4 billion. As 

of June 30, 2014, DoD had 1,682,423 individually billed2 travel cards. 

Defense Travel Management Office

The Defense Travel Management Office (DTMO) is the travel card program manager 

for all DoD Components. It provides guidance, policy, and coordinates training 

related to the DoD travel card program. DTMO is also the liaison to GSA, Citibank, 

and the Component Program Managers (CPMs) on all travel card‐related issues. 

DoD Comptrollers

The Military Department Assistant Secretaries (Financial Management and 

Comptroller) and Defense Agency Comptrollers, or equivalents, are required to 

ensure that program management responsibilities are accomplished within their 

respective Component. 

DoD Component Heads/Defense Agency Directors

The heads of the DoD Components are required to develop strategies to implement 

the Travel and Transportation Reform Act of 1998 in their respective Components. 

The Component heads will also ensure all personnel, including Agency Program 

Coordinators (APCs), Centrally Billed Account (CBA) Managers, and cardholders, are 

properly trained on travel card use and policy.

2 The DoD Travel Card Program has both individually billed travel cards and centrally billed accounts (CBAs). Individually 

billed travel cards are issued to DoD personnel. The cardholder is personally and financially liable for payment of 

all undisputed charges, including personal use, indicated on the billing statement, not the government. We discuss 

individually billed travel cards throughout the report. CBAs are provided to DoD activities to make travel arrangements 

for official federal government travel. We discuss CBAs in the Appendix.
Introduction

DODIG-2015-125 │ 3

Component Program Managers

CPMs are DoD personnel (military or civilian) designated in writing by the 

Component head or designee. They are required, but not limited to:

• establish and manage their respective travel card program; 

• establish and maintain the Component’s organizational 

structure (hierarchy); and 

• notify the DTMO and the travel card vendor of any changes in 

organizational structure that affect the travel card program.

Agency Program Coordinators

APCs are designated in writing by a commander or director and are responsible for 

program execution and management of the day-to-day operations of the DoD travel 

card program. APCs are required to:

• maintain or have access to all pertinent records such as:

{ statements of understanding; 

{ certificates of training; and 

{ delinquency notices for cardholders assigned to their hierarchy; 

• generate and review required reports; 

• use the data mining tools provided by the travel card vendor; 

• gather and analyze travel card data; and 

• identify incidents of suspected misuse.

Travel Cardholders

DoD personnel who have been issued a travel card for use while performing official 

Government travel must: 

• adhere to the procedures in the DoD Financial Management 

Regulation (FMR), Component guidance, and the travel card vendor’s 

cardholder agreement and terms and conditions of use; 

• use the travel card for all expenses related to official travel; 

• submit travel vouchers within 5 business days of completion of travel; 

• use split disbursement to pay all expenses charged to the card directly to 

the travel card vendor; and

• pay all undisputed charges in full by the due date on their billing statement, 

regardless of the status of their travel reimbursement. 
Introduction

4 │ DODIG-2015-125

Review of Internal Controls

DoD Instruction 5010.40, “Managers’ Internal Control Program Procedures,” 

May 30, 2013, requires DoD organizations to implement a comprehensive system of 

internal controls that provides reasonable assurance that programs are operating 

as intended and to evaluate the effectiveness of the controls. We identified internal 

control weaknesses associated with the DTMO Compliance Program’s lack of tools, 

techniques, and technologies to assist APCs in identifying personal use, merchants 

or categories that were considered high-risk for personal use, and requirements of 

Citibank to notify APCs of potential fraudulent activity or suspension of accounts. 

We will provide a copy of the report to the senior officials in charge of internal 

controls in the Military Departments, Defense agencies, Defense Travel Management 

Office, and DoD Field Activities.
Finding 

DODIG-2015-125 │ 5

Finding

DoD Government Travel Charge Cards Were Used at 

Casinos and Adult Entertainment Establishments

DoD cardholders improperly used their GTCCs for personal use3 at casinos and 

adult entertainment establishments. From July 1, 2013, through June 30, 2014, 

DoD cardholders had 4,4374 transactions, totaling $952,258, where they likely 

used their travel cards for personal use at casinos and had 900 additional 

transactions for $96,576 at adult entertainment establishments. We reviewed 

seven nonstatistically selected cardholders who had 76 transactions valued at 

$19,643 to confirm that our analysis identified personal use at casinos and adult 

entertainment establishments from July 1, 2013, through June 30, 2014. DoD did 

not detect these transactions because:

• the DTMO compliance program did not help APCs identify personal use 

at casino and adult entertainment establishments; 

• DoD policy did not specifically identify high-risk merchants or 

categories for personal use such as casinos or adult entertainment 

establishments; and

• Citibank was not required to notify APCs or management officials of 

potential fraudulent activity or suspension of accounts. 

As a result, CPMs and APCs did not have sufficient details on transactions that 

occurred at casinos or adult entertainment establishments to determine whether 

there was misuse. Unless DTMO, CPMs and APCs improve oversight actions, 

improve internal controls of the GTCC program, and provide written prohibition 

of the use of the GTCC at high-risk merchants, DoD personnel may continue to 

improperly use their GTCCs for personal use at casinos and adult entertainment 

establishments. Finally, without these controls in place the Department will not be 

able to identify and hold personnel accountable for misuse of the GTCC. 

3 Personal use is defined as use of the GTCC for expenses that do not relate to authorized expenses relating to official 

Government travel. This includes any use of Government charge cards at establishments or for purposes that are 

inconsistent with the official business of DoD or with applicable regulations. Personal use is misuse and may be 

considered abuse.

4 This includes transactions for organizations that do not use Defense Travel System such as U.S. Army Corps of Engineers 

and U.S. Air Force Reserve.
Finding

6 │ DODIG-2015-125

DoD Cardholders’ Personal Use of the Government 

Travel Charge Card 

DoD cardholders did not comply with DoD GTCC policy and improperly used their 

GTCC for personal use. DoD Financial Management Regulation (FMR)5 requires 

DoD personnel to use the GTCC for all costs related to official government travel 

and not for personal use. 

From July 1, 2013, through June 30, 2014, DoD cardholders used their cards 

to make over 20 million transactions totaling $3.4 billion. We queried the 

Visa IntelliLink Compliance Management system6 to obtain transactional data 

from July 1, 2013, through June 30, 2014, that occurred at casinos and adult 

entertainment establishments. 

The universe of U.S. casinos included 24,119 GTCC transactions by 

13,575 cardholders totaling $3,261,727. We analyzed the data to identify 

transactions at casinos that had indicators of personal use and to eliminate 

transactions that were for official use. As a result of this analysis, the 

universe of inappropriate transactions at casinos that were likely for 

personal use was 4,437 transactions by 2,636 cardholders totaling $952,258. 

The universe of U.S. adult entertainment establishments was 900 GTCC 

transactions by 646 cardholders totaling $96,576. Table 1 shows the casino 

and adult entertainment establishment transactions for each Service and the 

Defense agencies. 

Table 1. Casino and Adult Entertainment Establishment Transactions by Service and the 

Defense Agencies Where Personal Use Was Likely

Component Casino 

Transactions

Casino 

Amount ($)

Adult 

Transactions

Adult 

Amount ($)

Army 1,660 $348,538 365 $34,837

Navy 583 109,017 107 16,067

Air Force 1,803 404,675 347 37,491

Marine Corps 290 65,127 67 6,636

Defense 

Agencies 101 24,901 14 1,545

Total 4,437 $952,258 900 $96,576

NOTE: Cardholders are personally and financially liable for payment of all undisputed charges, 

including personal use, indicated on the billing statement, not the government. 

5 DoD Financial Management Regulation 7000.14-R, volume 9, chapter 3, “Department of Defense Government Travel 

Charge Card (GTCC).”

6 Visa IntelliLink Compliance Management is a web-based application that provides analytics and investigative reporting, 

misuse detection, program compliance, and regulatory compliance.
Finding 

DODIG-2015-125 │ 7

After we identified the universe of transactions where DoD personnel likely used 

their travel cards for personal use at casinos or adult entertainment 

establishments, we reviewed seven cardholders who had 76 transactions, valued at 

$19,643, for personal use. We selected the seven cardholders using their activity 

from July 1, 2013, through June 30, 2014; however, after identification, we reviewed 

additional transactions beyond those dates to determine whether there was prior 

or subsequent abuse. See Appendix for the scope and methodology related to our 

audit objective. 

Improvements Needed for Detection of Personal Use 

The CPMs and APCs did not detect that DoD personnel improperly 

used their GTCC for personal use at casinos and adult 

entertainment establishments. Public Law 112‐194 requires 

each executive agency to use effective systems, techniques, 

and technologies to prevent or identify improper purchases. 

In April 2013 the DTMO Compliance Program began 

using an automated tool, the Travel Policy Compliance Tool 

(compliance tool), to review all DoD Defense Travel System 

(DTS) travel vouchers for compliance with DoD travel policy. 

However, the compliance tool did not review GTCC transactions for 

personal use. 

To comply with Public Law 112-194 requirements to prevent or identify improper 

purchases, DTMO personnel need to modify the compliance tool or use other 

systems, techniques, and technologies to identify personal use at casinos and adult 

entertainment establishments and notify the CPMs and APCs of potential abuses 

(repetitive misuse) of the GTCC. The Director, DTMO, should coordinate with the 

Military Services, Defense agencies, and Citibank representatives to determine 

what tools, techniques, or technologies are most appropriate to prevent or identify 

personal use of the GTCC at casinos and adult entertainment establishments.

During our detailed review of the seven cardholders there were several common 

attributes of the GTCC transactions that we confirmed as personal use of the 

GTCC. These attributes were used to identify the universe of transactions as 

high risk for misuse including 4,437 transactions totaling $952,258 at casinos and 

900 transactions for $96,576 at adult entertainment establishments. Specifically, 

the attributes include GTCC:

• transactions with no associated travel status in DTS;

• automated teller machine (ATM) withdrawals that exceeded the overall 

Meal and Incidental Expense (M&IE) amounts while in a travel status;

CPMs 

and APCs 

did not detect 

that DoD personnel 

improperly used 

their GTCC for 

personal use.
Finding

8 │ DODIG-2015-125

• transactions at known casinos and adult entertainment establishments; 

• declined authorization activity that could indicate personal use; and

• activity outside the required official Government travel locations.

Use of the Government Travel Charge Card While Not in Travel 

Status Could Indicate Personal Use

DoD personnel improperly used their GTCC at casinos or adult entertainment 

establishments while not in official travel status; however, the Director, DTMO 

did not have the tools in place to identify the improper use. Three of the seven 

cardholders reviewed used their GTCC for transactions at casinos or adult 

entertainment establishments while not in official travel status. The DoD FMR 

states that the GTCC is not for personal use and travel cards are to be used only for 

official travel-related expenses. Additionally, misuse specifically includes ATM cash 

withdrawals made during nontravel periods. 

As indicated in the example below, GTCC transactions that occur outside of official 

Government travel status indicate abuse of the GTCC. However, not all APCs had 

access to the travel systems to determine whether the cardholders were on official 

travel status. Furthermore, DTMO personnel informed us that the role of an APC 

was not always a primary duty, and DoD management decided what level of travel 

system access should be granted. 

In our example, if the CPM or APC had been systematically notified of the 

transactions that occurred outside of official Government travel, the CPM or APC 

could have reviewed the transactions, which may have prevented the cardholder 

from abusing the GTCC for over 2 years. The Director, DTMO, should coordinate 

with the Military Services, Defense agencies, and Citibank representatives to 

determine what tools, techniques, or technologies are most appropriate to identify 

GTCC transactions that did not have associated travel status in DTS or other 

DoD travel systems. 

Defense Logistics Agency Cardholder Used the Government Travel Charge 

Card at Maryland Live! Casino

A Defense Logistics Agency (DLA) civilian employee used the GTCC 29 times 

between October 2012 and September 2014 to obtain nearly $5,000 in cash while 

not in travel status. Of the 29 transactions, the cardholder had 19 transactions at 

Maryland Live! Casino in Hanover, Maryland, totaling $3,366. The cardholder also 

attempted three cash withdrawals that were declined at the casino totaling $402. 
Finding 

DODIG-2015-125 │ 9

Defense Logistics Agency Management Actions

The DLA officials took action against the cardholder after we informed them of 

the transactions. During an interview with the cardholder’s CPM and supervisor, 

the CPM stated the cardholder’s APC did not identify the transactions, and 

DLA management was unaware until we notified them of our findings. After we 

notified DLA management, they investigated the transactions further, and: 

• the CPM immediately deactivated the cardholder’s GTCC; 

• management suspended the employee for 3 days without pay after a full 

review and appeals process; and

• DLA officials removed the cardholder’s APC from the GTCC 

oversight responsibilities. 

Cash Withdrawals That Exceed Meal and Incidental Expenses 

While in Travel Status Could Indicate Personal Use

DoD cardholders made cash withdrawals that exceeded their meals and 

incidentals (M&IE) allotment, which could have indicated improper personal 

use. However, the Director, DTMO did not have the controls in place to identify 

excessive withdrawals. Four of the seven cardholders had transactions that 

exceeded the total M&IE allotted to each traveler for the trip. In addition, of the 

casino transactions we provided to the CPMs for review, 673 transactions for 

$134,864 were cash withdrawals and exceeded the M&IE allotted to each traveler 

for the trip. 

The DoD FMR specifies that the GTCC is the primary payment method for official 

travel expenses incurred by DoD personnel. The GTCC is not for personal use 

and may not be used for any individuals other than the cardholder and his or her 

authorized dependents. Transactions that exceed M&IE amounts while in travel 

status could indicate personal use. However, according to DoD personnel, not all 

APCs have access to travel systems to identify cardholders who exceed the overall 

M&IE amounts for a trip. 

In the example below, if the CPM or APC had been systematically notified of the 

risky transactions, the CPM or APC could have reviewed the transactions and taken 

timely action. The Director, DTMO, should coordinate with the Military Services, 

Defense agencies, and Citibank representatives to determine what tools, techniques, 

or technologies are most appropriate to identify GTCC transactions that exceeded 

the total M&IE received during official Government travel.
Finding

10 │ DODIG-2015-125

Navy Cardholder Used Government Travel Charge Card at Four Adult 

Entertainment Establishments

A petty officer first class from the Naval Special Warfare Group used the GTCC at 

multiple adult entertainment establishments while on official 

Government travel to El Paso, Texas. While in El Paso, the 

cardholder spent more than six times his total M&IE at 

four different adult entertainment establishments, which 

included Dreams Cabaret, Jaguars Gold Club, Tequila 

Sunrise, and Red Parrot Gentlemen’s Club. 

The petty officer only received $151.50 in M&IE for 

17 days of travel because his meals were provided, except 

for the first and last day of travel. However, he still incurred 

12 transactions for $1,116 at adult entertainment establishments during his 

17 days of travel. The petty officer also charged an additional $642 on his GTCC for 

food, drinks, and ATM withdrawals at locations that were not adult entertainment 

establishments. In total, he spent $1,758 on his GTCC but only received $151.50 

in M&IE.

Navy Management Actions

Navy officials took action against the cardholder after we informed them of the 

transactions. Based on our discussion with the CPM and APC, neither the CPM nor 

APC detected the transactions. The APC stated that the actions of the cardholder 

were sent to the disciplinary review board after we informed the cardholder’s 

supervisor and other Navy officials of the transactions. According to an e-mail 

from the APC, the cardholder received written counseling for:

• misuse of GTCC for unauthorized personal expenses;

• withdraws that exceeded cash limits established on the card that were not 

necessary or reasonable; and

• charges from unauthorized establishments while in El Paso, Texas through 

ATM withdrawals at bars, taverns, and restaurants, which exceeded the 

authorized per diem limit at his travel location.

As a result of the Disciplinary Review Board’s finding, the cardholder was 

required to:

• complete Travel Card 101 training, 

• sign and date a new statement of understanding for the GTCC, and 

• provide a general military training session to his department and division 

personnel for proper use of the GTCC in accordance with DoD Directives. 

The 

cardholder 

spent more than 

six times his total 

M&IE at four different 

adult entertainment 

establishments.
Finding 

DODIG-2015-125 │ 11

Using Merchant Names Could Assist Agency Program 

Coordinators to Identify Potential Personal Use

APCs either did not identify improper personal use by reviewing the merchant 

names or could not determine the type of establishments by reviewing the 

merchant names. Also, the DTMO Travel Policy Compliance Tool did not data mine 

for casino or adult entertainment establishments’ merchant names to identify 

personal use. 

Four of the seven cardholders reviewed had GTCC transactions 

at several adult entertainment establishments, including:

• Dreams Cabaret for $308;

• Vegas Showgirls for $2,100; 

• Larry Flynt’s Hustler Club for $1,614; and 

• Sapphire Gentlemen’s Club for $4,686. 

The method DoD used to block the 

Merchant Category Codes (MCCs)7 was not 

effective to prevent personal use of the GTCC at casinos and 

adult entertainment establishments. The MCCs identified 

with the purchases were either ATM transactions or 

restaurant purchases. DoD coordinated with Citibank to 

prevent the use of the GTCC at specific types of merchants 

by using the MCC. CPMs and APCs relied on blocked MCCs to 

ensure cardholders did not use their GTCCs at unauthorized 

locations, such as adult entertainment establishments. 

Many adult entertainment establishments can circumvent the blocked MCC by 

using a MCC related to ATMs, bars, or restaurants to disguise the true nature of the 

business. In addition, casinos and adult entertainment establishments may appear 

on GTCC billing statements under a variety of names. 

Casinos and casino-processing companies cannot be blocked by MCC because 

travelers may use these locations for legitimate travel expenses. DoD had 

24,119 transactions that occurred at casinos and casino processing centers; 

however, not all transactions at casinos represent personal use. During interviews, 

several APCs stated they may not have been aware that transactions were 

occurring at casinos because of the merchant name that appeared on the 

GTCC billing statement. 

7 An MCC is a four-digit number assigned to a business by MasterCard or Visa when the business first starts accepting 

one of these cards as a form of payment. The MCC is used to classify a business by the type of goods or services 

provided. The Department blocks some MCCs to prevent inappropriate card use.

Cardholders 

used their GTCC 

at Dreams Cabaret, 

Vegas Showgirls, 

Larry Flynt’s Hustler 

Club, and Sapphire 

Gentlemen’s 

Club.

The 

method DoD 

used to block 

the MCCs was not 

effective to prevent 

personal use.
Finding

12 │ DODIG-2015-125

For example, DiTRONICS Financial Services provided cash access services and 

ticket redemption kiosks to casinos, and DiTRONICS was the merchant name on 

the billing statement. Unless the APC or other reviewing officials were aware that 

DiTRONICS was a specific cash access service for casinos, they would not know to 

question the transactions that occurred. 

CPMs and APCs cannot be expected to know the names of all adult entertainment 

establishments and casinos or casino-processing centers. The Director, DTMO, 

should coordinate with the Military Services, Defense agencies, and Citibank 

representatives to determine what tools, techniques, or technologies are most 

appropriate to indicate GTCC transactions that occur at specific known casino 

and adult entertainment establishments. In addition, the Director, DTMO, should 

coordinate with the General Services Administration to determine whether 

Citibank should be required to block usage of the Government travel charge card 

at specific casino locations or adult entertainment establishments known for 

personal use. 

Multiple Declined Authorizations Could Indicate Personal Use

DTMO personnel did not provide an automated, real-time notification of high‐risk 

declined transactions to APCs. Six of the seven cardholders reviewed had declined 

authorizations. Citibank Custom Reporting System contains a standard report that 

can be run to identify declined authorizations within a given hierarchy. The report 

lists all transactions attempted but declined against an account and details the 

reasons the transaction was declined and type of purchase attempted. 

As shown in the example below, declined authorizations may indicate personal use. 

Although Citibank made this report available to the APCs, they were not required 

to generate it for review. In addition, the DoD FMR does not require CPMs or APCs 

to review the Declined Authorizations Report. 

When cardholders use their GTCCs for personal use, the individuals are more likely 

to have multiple declined authorizations. The Director, DTMO, should coordinate 

with the Military Services, Defense agencies, and Citibank representatives to 

review the reasons for declined authorizations and to determine what tools, 

techniques, or technologies are most appropriate to identify GTCC declined 

authorization activity that could indicate personal use. 
Finding 

DODIG-2015-125 │ 13

Army Cardholder Used Government Travel Charge Card at 

Pechanga Resort and Casino

An Army Reserve sergeant first class with the 416th Civil Affairs Battalion abused 

the GTCC at Pechanga Resort and Casino in Temecula, California, which was only 

8.6 miles from his residence. From March 1, 2011, through October 12, 2014, the 

cardholder had 83 transactions at Pechanga Resort and Casino that totaled $16,415. 

The majority of the transactions occurred while the cardholder was not on official 

Government travel. In addition, the cardholder had 90 declined transactions from 

March 1, 2011, through October 16, 2014, totaling $14,478. Citibank declined the 

transactions for multiple reasons, four of which indicated potential personal use:8

• 18 transactions, totaling $2,530, were declined because the card 

was deactivated, 

• 8 transactions, totaling $1,392, were declined for reaching the daily 

ATM dollar limit,

• 5 transactions, totaling $520, were declined for reaching the daily 

ATM transaction limit, and

• 57 transactions, totaling $9,768, were declined for exceeding the 

card’s credit limit. 

The cardholder also showed a pattern in his declined authorizations. On several 

occasions after the initial declined transactions, the cardholder reduced the 

amount requested until the individual successfully obtained cash. For example, on 

May 28, 2013, the cardholder had six declined authorizations within 13 minutes. 

After successfully withdrawing $204 at the casino, Citibank declined an attempt 

to withdraw another $204 because the cardholder did not have enough available 

credit. The cardholder then attempted to withdraw $184, $164, $164, $144, and 

$104 within that 13-minute period. All requests were declined because of the lack 

of available credit. 

Army Management Actions

Army officials took management action against the cardholder after we informed 

them of the transactions. A commander’s inquiry determined that the cardholder 

would receive a letter of reprimand.9 Neither the CPM nor APC were aware of the 

cardholder’s personal use of the GTCC. 

8 Two transactions, totaling $268, were declined for invalid personal identification number. We did not consider this 

reason to be an indicator of personal use.

9 A form of administrative punishment. 
Finding

14 │ DODIG-2015-125

Government Travel Charge Card Activity Outside of Official 

Travel Location Could Indicate Personal Use

DoD cardholders improperly used the GTCC while on official travel for personal use 

in locations other than the city or surrounding area of their travel; however, the 

Director, DTMO did not have controls in place to detect these transactions. Of the 

seven cardholders reviewed, two used the GTCC in locations other than the city or 

surrounding area of their travel. In some cases, the casinos where the GTCC was 

used were more than an hour away from the official temporary duty (TDY) location 

or near the individual’s home residence. The DoD FMR specifically states that the 

GTCC should only be used while on official orders and performing duties pertaining 

to official Government assignments. 

APCs and cardholder supervisors could take timely corrective action, including 

deactivating the card or disciplining cardholders who abuse the GTCC, if 

DoD had a systematic way to identify transactions for review. The Director, 

DTMO, should coordinate with the Military Services, Defense agencies, and 

Citibank representatives to determine what tools, techniques, or technologies 

are most appropriate to identify GTCC activity outside the official government 

travel locations.

Air Force Cardholder Used Government Travel Charge Card at 

Ultron Casino ATM

A U.S. Air Force civilian employee from Warner Robbins Air Force Base, Georgia 

traveled 300 miles (round trip) from his travel location and used his GTCC at a 

casino. The cardholder was on official Government travel to Hill Air Force Base, 

Utah and used his GTCC at Ultron ATMs in West Wendover, Nevada.10 Ultron ATMs 

are predominately associated with casinos throughout the United States. 

On four occasions, the cardholder used his GTCC seven times at the West Wendover 

location to withdraw over $1,500 from ATMs at a casino where he had nine 

declined transactions totaling $2,363. The APC stated that he noticed the 

Ultron ATM withdrawals while performing his review of the activity and spoke to 

the cardholder at the time. He could not remember any details of the conversation, 

but indicated that he found nothing improper with the transactions. 

As a result of our audit, the human resources supervisor performed an updated 

interview of the cardholder on October 28, 2014. During the interview, the 

cardholder stated that he obtained the $1,500 in cash in West Wendover, Nevada 

to pay for food and drinks while he attended car races, shows, and local events. 

The cardholder denied that he used the money to gamble at casinos. 

10 West Wendover is a destination resort community that is located on the Nevada-Utah border and has five prominent 

gambling establishments.
Finding 

DODIG-2015-125 │ 15

Air Force Management Actions

Air Force officials did not take disciplinary action against the cardholder after we 

informed them of the transactions. Although the human resource supervisor could 

not conclude that the cardholder used his GTCC for gambling purposes at a casino, 

he concluded that the cardholder used his GTCC for personal use and should have 

been disciplined. However, members of the Employee Relations Board stated they 

could not take disciplinary action because of the time that had passed since the 

unauthorized use. The board stated that in accordance with the employee’s labor 

agreement the cardholder’s supervisor should have investigated the misconduct 

and submitted his findings to the Employee Relations Board within 45 days from 

the time of the occurrence or identification of potential misuse. 

If the APC would have identified the transactions and properly investigated, then 

the Employee Relations Board could have taken appropriate disciplinary actions 

within the required time frames. 

Defense Travel Management Office Needs to Update 

the DoD Financial Management Regulation

DTMO personnel have not provided sufficient guidance through the DoD FMR to 

detect DoD personnel that improperly used the GTCC for personal use at casinos 

and adult entertainment establishments. Specifically, the DoD FMR does not:

• prohibit merchant types that should be considered high risk for personal 

use such as casinos and adult entertainment establishments;

• require APCs to review the declined authorization report for suspicious 

activity; and 

• require APCs to use the Visa IntelliLink tool to assist in their reviews of 

monthly GTCC activity for personal use or other misuse.

Prohibit High-Risk Merchants

Although DTMO took action to block specific MCCs, it did not provide detailed 

guidance on the merchant types that should not be visited by 

DoD employees. Several APCs expressed concern that 

DoD policy did not specifically prohibit merchant types 

that should be considered high risk for personal use 

such as casinos or adult entertainment establishments. 

One APC indicated concern over disciplining 

cardholders when DoD guidance did not specifically 

prohibit adult entertainment establishments. The 

APCs 

expressed 

concern that 

DoD policy did not 

specifically prohibit 

merchant types that 

should be considered 

high risk for 

personal use.
Finding

16 │ DODIG-2015-125

Director, DTMO, should revise DoD FMR Volume 9, Chapter 3 to include examples of 

merchant categories that are considered high risk for personal use such as casinos 

and adult entertainment establishments. 

Require Review of Declined Authorizations Report

Six of the seven cardholders had declined transactions, which showed that declined 

authorizations were a good indicator of personal use. Citibank Custom Reporting 

System contains a declined authorizations report that all APCs could generate for 

their hierarchy; however, the APCs were not required to run or review the report. 

The DoD FMR states that the declined authorizations report lists all transactions 

attempted but declined against an account. It also details the reasons for decline 

and type of purchase, but states that APC review of the report is optional. The 

Director, DTMO, should require APCs to review the declined authorization report at 

least monthly for suspicious activity. 

Provide APCs Access to Visa IntelliLink and Require Its Use 

The DoD FMR states that APCs use of Visa’s data mining tools to gather and 

analyze GTCC data and identify incidents of suspected misuse is optional. We used 

Visa IntelliLink as a data mining tool to locate the transactions we reviewed and 

sent to the CPMs for review. The Director, DTMO, should require APCs to use the 

Visa IntelliLink tool to assist in their reviews of monthly GTCC activity for personal 

use or other misuse. 

Citibank Not Required to Notify the Agency Program 

Coordinator of Fraudulent Activity or Suspension of 

Travel Cards

APCs were unaware of fraudulent activity identified by Citibank or its suspension 

of GTCC accounts because Citibank was not required to alert them. Under the 

contract, Citibank was not required to notify the CPM or 

APC of potentially fraudulent activity or suspension of 

a cardholder’s account. If Citibank would have been 

required to notify Air Force officials of the suspicious 

activity in the example below, then they could have 

detected the personal use earlier. It would have also 

reduced the possibility that if the cardholder had 

paid the full balance before reactivation, then the APC 

would not have identified the abuse. The Director, DTMO, 

should coordinate with GSA to determine whether the Citibank 

contract should be modified to require Citibank to notify a cardholder’s CPM or 

APC of potential fraudulent use or suspension of travel cards. 

Citibank 

was not 

required to notify 

the CPM or APC of 

potentially fraudulent 

activity or suspension 

of a cardholder’s 

account.
Finding 

DODIG-2015-125 │ 17

Air Force Cardholder Used Government Travel Charge Card at 

Sapphire Gentlemen’s Club

A senior airman from the 4th Aircraft Maintenance Squadron at Seymour Johnson 

Air Force Base, North Carolina used the GTCC for personal use while on official 

Government travel to Nellis Air Force Base, Nevada near Las Vegas. 

The cardholder’s total per diem for the travel was $359.25. 

During his travel, the cardholder had three purchases at 

Sapphire Gentlemen’s Club totaling $4,686. In addition, 

Citibank declined another GTCC transaction for $920 

because the transaction would have exceeded his card’s 

credit limit. The cardholder later admitted that he used 

his GTCC at the Sapphire Gentlemen’s Club VIP room for 

himself and several friends. 

As a result of the Squadron’s policy to deactivate GTCCs while not in travel status 

and reactivating the GTCC when necessary, the Air Force resource advisor detected 

the transactions when reactivating the GTCC. Although the resource advisor 

detected the transactions, it was about 48 days after the transactions occurred. 

Additionally, the resource advisor only detected the transactions when activating 

the GTCC for an upcoming trip and noted the cardholder had a delinquent 

balance of $4,923. After contacting Citibank officials, Citibank officials informed 

the resource advisor that they notified the cardholder of potentially fraudulent 

activity on the GTCC, and the cardholder informed Citibank officials that the 

transactions were valid. The Director, DTMO, should determine the feasibility of 

deactivating travel cards and reducing travel card limits for cardholders while not 

on official travel.

Air Force Management Actions

The Air Force officials took action against the cardholder after they identified 

the transactions. The Resource Advisor identified potentially unauthorized 

transactions and notified the cardholder and his supervisor. The cardholder’s 

supervisors conducted a review and determined the transactions were for personal 

use. As a result, the cardholder was issued an Article 1511 and reduced his rank 

from senior airman (E-4) to airman first class (E-3). 

11 A form of administrative punishment.

The 

cardholder 

later admitted that 

he used his GTCC 

at the Sapphire 

Gentlemen’s Club 

VIP room.
Finding

18 │ DODIG-2015-125

Management Actions

For the seven cardholders reviewed, management confirmed that the transactions 

we identified were personal use of the GTCC and confirmed the misuse or abuse 

that our analysis detected. 

On October 23, 2014, we provided the CPMs at each Military Service a list of 

886 transactions related to adult entertainment establishments, valued at $95,031, 

that we identified using Visa IntelliLink. We received responses from the Services 

from December 2014 through February 2015. A summary of their reviews is 

provided in Table 2. 

Table 2. Results from Military Service CPM and APC’s review of Adult Entertainment 

Establishment Transactions

Service Action 

Taken1 Pending

No Action 

Taken with 

Reason2

No Action 

Taken3

Transaction 

Not 

Reviewed

Total

Army 146 31 40 117 31 365

Navy 66 15 6 19 1 107

Air Force 138 22 24 97 66 347

Marine 

Corps 17 11 4 19 16 67

Total 367 79 74 252 114 886

1 Actions taken include counseling, training, letters of reprimand, and reduction in rank. 

2 No action taken because cardholder either separated from the command, retired, or successfully disputed the charge 

with Citibank.

3 APCs reviewed these transactions, but no action was taken for reasons including: the cardholder did not know it was 

an adult establishment, “transactions not unauthorized,” or the APC stated that the cardholder was TDY during the 

transaction (implying that personal use cannot happen while on TDY).

On December 24, 2014, we provided the CPMs at each Military Service a list of 

4,336 transactions, valued at $927,358, that were high risk for personal use at 

casinos or casino-processing centers by using Visa IntelliLink and DTMO data. In 

addition in January 2015, we provided DLA, Defense Contract Management Agency, 

and Defense Threat Reduction Agency lists of high-risk transactions from their 

agency. In total, the three agencies had 56 high-risk transactions, valued at 

$15,458 at casinos or casino processing centers. We received responses on a draft 

of this report from the Service CPMs regarding their reviews of high risk 

transactions that were not complete or sufficient. Therefore, CPMs at each Military 

Service should complete their reviews of the transactions and provide the results 

of the review to us no later than June 30, 2015.
Finding 

DODIG-2015-125 │ 19

Conclusion 

The CPMs and APCs did not detect when DoD personnel improperly used their 

GTCC for personal use at casinos and adult entertainment establishments. From 

July 1, 2013, through June 30, 2014, DoD cardholders had 4,43712 transactions, 

totaling $952,258, where they likely used their travel cards for personal 

use at casinos and had 900 additional transactions for $96,576 at adult 

entertainment establishments. 

Unless DTMO and the CPMs improve oversight actions, improve internal controls 

of the GTCC program, and provide written prohibition of personal use of the GTCC 

at casinos and adult entertainment establishments, DoD personnel may continue to 

use their GTCCs for personal use at these establishments. Furthermore, APCs will 

not have the tools to allow for automated detection of personal use transactions 

from the millions of GTCC transactions each year. 

Management Comments on the Finding 

and Our Response

Defense Travel Management Office Comments

The Director, Defense Travel Management Office stated that the report does not 

call attention to the strength of the DoD Government Charge Card program and 

that personal use is negligible compared to the size and scope of the program. The 

Director supports the strength of the program by stating the delinquency rate for 

individually billed accounts was 1 percent for FY15 second quarter and was much 

lower than the industry average of 4 percent. He also states that the personal use 

identified in the report is less than 0.5 percent of the total transactions and dollars 

spent on individually billed accounts. Finally, the Director stated that personal use 

does not result in the loss of U.S. taxpayer dollars because the cardholder is not 

reimbursed for the expenses. 

Our Response

The overall objective of the audit was to determine whether DoD Government 

travel charge card holders used their card for personal use at casinos or adult 

entertainment establishments. Therefore, the audit team cannot draw conclusions 

on the overall personal use of the GTCC program or the overall strength of 

the program. 

12 This includes transactions for organizations that do not use Defense Travel System such as U.S. Army Corps of 

Engineers and U.S. Air Force Reserve. 
Finding

20 │ DODIG-2015-125

Recommendations, Management Comments, 

and Our Response

Recommendation 1.a

We recommend that the Director, Defense Travel Management Office:

Establish a working group with the Military Services, Defense agencies, and 

bank representatives to determine what tools, techniques, or technologies are 

most appropriate to prevent or identify personal use of the Government travel 

charge card at casinos and adult entertainment establishments. Specifically 

the tools, techniques or technologies should enable Agency Program 

Coordinators to identify:

1. Travel card transactions that do not have associated travel status in 

Defense Travel System or other DoD travel systems; 

2. Automated teller machine withdrawals that exceed the overall meal 

and incidental expense amounts while in a travel status; 

3. Travel card transactions that occur at specific known casinos, casinoprocessing centers, and adult entertainment establishments; 

4. Travel card declined authorization activity that could indicate 

personal use; and 

5. Travel card activity outside the official Government travel location.

Defense Travel Management Office Comments 

The Director, Defense Travel Management Office, agreed, but stated that a specific 

working group does not need to be established to determine what tools, techniques, 

or technologies are most appropriate to prevent or identify personal use of the 

Government Travel Charge Card (GTCC). The Director stated that DTMO actively 

engages with CPMs and Citibank on a daily basis as well as through quarterly 

meetings and program reviews.

The Director stated that DTMO conducted refresher training on the Citibank 

Customer Reporting System and Visa IntelliLink to identify potential personal 

use of the card and plans to include a training course for the APCs on the 

use of the tools at the GSA SmartPay Forum. He also indicated that DTMO 

created new reports in Visa IntelliLink to identify use at casinos and adult 

entertainment establishments.
Finding 

DODIG-2015-125 │ 21

The Director stated that DTMO specifically designed and developed the 

Compliance Tool to identify and assist with the recovery of improper or overpaid 

travel reimbursements (or both). He continued by stating that there would not be 

a return on investment if DTMO enhanced the tool to identify personal use of the 

travel card. 

Our Response

Comments from the Director, Defense Travel Management Office partially 

addressed the recommendation. Although the Director did not agree to establish 

a working group, he did agree to engage with the CPMs and Citibank. He also 

referenced a focus on improved and more prevalent usage of the Citibank Customer 

Reporting System and Visa IntelliLink to identify potential personal use of the card, 

specifically related to casinos and adult entertainment establishments. 

Although we recognize the potential the Compliance Tool has to identify personal 

use of the GTCC, we recommended that the Director, in coordination with other 

key stakeholders, determine what tools, techniques, or technologies are most 

appropriate to prevent or identify personal use of the Government travel charge 

card at casinos and adult entertainment establishments. While the Director’s 

response partially addressed the recommendation, he did not address the types of 

tools, techniques, or technologies he considered to identify:

• Travel card transactions that do not have associated travel status in 

Defense Travel System or other DoD travel systems;

• Automated teller machine withdrawals that exceed the overall meal 

and incidental expense amounts while in a travel status;

• Travel card declined authorization activity that could indicate personal 

use; or 

• Travel card activity outside the official Government travel location.

Therefore, we ask that the Director provide additional comments in response to the 

final report that describes the specific tools, techniques, or technologies that would 

identify the transactions outlined in the recommendation.
Finding

22 │ DODIG-2015-125

Recommendation 1.b

Determine the feasibility of deactivating travel cards and reducing travel card 

limits for cardholders while not on official travel.

Defense Travel Management Office Comments

The Director, Defense Travel Management Office, agreed, stating that the current 

DoD and OMB policy is to deactivate restricted accounts for cardholders not in a 

travel status. He stated that DTMO personnel are currently working with Citibank 

and the CPMs to improve enforcement of the policy. 

Our Response

Comments from the Director partially addressed the recommendation. While 

we commend the Director for having the policy in place to deactivate restricted 

accounts, there is a benefit to deactivate all cardholder accounts that are not in 

an official travel status. Therefore, we ask that the Director provide additional 

comments on the feasibility of a systematic process to deactivate all DoD travel 

cards for cardholders who are not in an official travel status.

Recommendation 1.c

Revise the DoD Financial Management Regulation, volume 9, chapter 3 to 

include examples of merchant categories that are considered high risk for 

personal use, such as casinos and adult entertainment establishments.

Defense Travel Management Office Comments

The Director, Defense Travel Management Office, disagreed, stating that the 

DoD FMR, Volume 9, Chapter 3 clearly prohibits card use for other than official 

authorized expenses in support of official travel.

Our Response

Comments from the Director partially addressed the recommendation. We agree 

that the DoD FMR, Volume 9, Chapter 3, clearly prohibits personal use. However, 

DoD GTCC officials indicated during the audit that the policy needed to specifically 

prohibit the personal use at casinos and adult entertainment establishments, so the 

APCs may hold commanders accountable. 

The Director provided a draft of DoD Instruction 5154.31, which is scheduled to 

replace DoD FMR, Volume 9, Chapter 3. Upon reviewing the updated draft policy, 

we determined that while the policy does not specifically mention casinos and adult 
Finding 

DODIG-2015-125 │ 23

entertainment establishments, it does provide added emphasis of the prohibition of 

personal use at establishments inconsistent with official DoD business:

It is DoD policy that improper, fraudulent, abusive, or negligent use 

of a travel card is prohibited. This includes any use of a travel card 

at establishments or for purposes that are inconsistent with the 

official business of DoD or with applicable regulations...In addition, 

civilian personnel who fail to satisfy an indebtedness arising from 

the use of a travel card or those who fail to do so in a timely manner 

may be subject to corrective or disciplinary/adverse action. The 

intent is to ensure that management emphasis is given to personal 

accountability for travel card misuse.

While we understand there are legitimate uses of the GTCC at casinos, we 

believe the updated policy provides the APCs with the guidance necessary to 

hold commanders accountable. We request that the Director provide the date of 

issuance for the updated DoD Instruction.

Recommendation 1.d.1

Require Agency Program Coordinators to review the declined authorization 

report at least monthly.

Defense Travel Management Office Comments

The Director, Defense Travel Management Office, disagreed, stating that the 

declined authorization report is not a viable tool to identify personal use. The 

Director also stated that the report would be difficult and time consuming for 

an APC to review and extract information from it that would indicate improper 

personal use.

Our Response

Comments from the Director did not address the specifics of the recommendation. 

We disagree that the declined authorization report is not a viable tool to identify 

personal use. For example, six of the seven cardholders reviewed included declined 

transactions related to attempted personal use. If DTMO officials work with 

Citibank and the CPMs to determine the reason codes related to personal use 

within the declined authorization report (for example, blocked merchants, daily 

ATM limit, or not enough available funding), the APCs would not spend excessive 

amounts of time to extract the information needed to detect personal use. 

Therefore, we request that the Director provide additional information, or propose 

an alternative course of action, on how APCs can get the information they need to 

periodically review declined transactions. 
Finding

24 │ DODIG-2015-125

Recommendation 1.d.2

Require Agency Program Coordinators to use the Visa IntelliLink tool to 

assist in the reviews of monthly Government travel charge card activity for 

personal use or other misuse.

Defense Travel Management Office Comments

The Director, Defense Travel Management Office, agreed, stating that Visa IntelliLink 

is a valuable tool for providing information regarding potential personal use or 

misuse. However, the Director also stated that Citibank Custom Reporting System is 

another valuable tool that provides this information. DTMO does not want to limit 

the APCs by requiring one tool over another, but the updated draft policy will require 

APCs to use either Visa IntelliLink or Citibank Custom Reporting System.

Our Response

Comments from the Director partially addressed the recommendation. We agree 

that the Citibank Custom Reporting System and Visa IntelliLink are both valuable 

tools, but disagree that requiring the use of Visa IntelliLink would limit an APC’s 

use of the other tools. The Visa IntelliLink system includes unique features 

including a risk predictor score that identifies high-risk transactions, as well as 

a case disposition tracking system for those high-risk transactions. Neither of 

those functions are available in the Citibank system. Also, the Director referenced 

new reports in Visa IntelliLink that were designed to identify use at casinos and 

adult entertainment establishments, which the APCs should be required to review 

on a monthly basis. Therefore, we request that the Director provide additional 

information, or propose an alternative course of action, on how the use of Citibank 

Custom Reporting System will provide all information available in Visa IntelliLink.

Recommendation 1.e.1

Coordinate with the General Services Administration to determine whether 

the Citibank contract should be modified to require Citibank to block usage 

of the Government travel charge card at specific casino locations or adult 

entertainment establishments.

Defense Travel Management Office Comments

The Director, Defense Travel Management Office, agreed, stating that DTMO 

will coordinate with GSA to determine whether the Citibank contract should 

be modified.

Our Response

Comments from the Director addressed the recommendation, and no further 

comments are required.
Finding 

DODIG-2015-125 │ 25

Recommendation 1.e.2

Coordinate with the General Services Administration to determine whether 

the Citibank contract should be modified to require Citibank to notify 

Component Program Managers or Agency Program Coordinators of potential 

fraudulent use or suspension of travel cards.

Defense Travel Management Office Comments

The Director, Defense Travel Management Office, agreed, stating that DTMO will 

coordinate with GSA and discuss with Citibank on whether it is possible and 

feasible to modify the contract.

Our Response

Comments from the Director addressed the recommendation, and no further 

comments are required.

Recommendation 2 

We recommended that the Army Component Program Manager complete a 

review of the casino transactions and provide the results of the review to us 

no later than April 8, 2015.

Army Comments

The Deputy Assistant Secretary of the Army, Financial Operations, responding 

for the Army Component Program Manager, stated that the transactions were 

reviewed and the command’s comments were forwarded to the DoD OIG by 

April 8, 2015. The Deputy Assistant Secretary also stated that the Army will 

continue to respond to requests for clarification of the command comments. The 

Army Component Program Manager provided the results of the casino transaction 

review in a spreadsheet and command’s comments for some Army organizations. 

Due to the size and amount of data in the spreadsheets, we did not include them in 

the report. 

Our Response

Comments from the Deputy Assistant Secretary partially addressed the 

recommendation. The Army Component Program Manager provided results in a 

spreadsheet that did not include all of the Army organizations, and some results 

had blank responses. In addition, we determined the Army Component Program 

Manager did not perform sufficient reviews of all transactions. For example, 

he reported instances of quasi-cash13 transactions as appropriate use with no 

explanation. We believe quasi-cash transactions at casinos are strong indicators of 

13 Transactions at a casino cage for noncash items such as gambling chips.
Finding

26 │ DODIG-2015-125

personal use and lead us to question the sufficiency of the review. Therefore, we 

returned the results to the Army Component Program Manager and request that he 

provide complete, sufficient results of the review to us no later than June 30, 2015.

Recommendation 3 

We recommended that Navy Component Program Manager complete a review 

of the casino transactions and provide the results of the review to us no later 

than April 8, 2015.

Management Comments Required 

The Navy Component Program Manager provided the results of the casino 

transaction review in a spreadsheet on April 9, 2015. Due to the size and 

amount of data in the spreadsheets, we did not include them in the report. 

Our Response

The Navy Component Program Manager provided results in a spreadsheet, 

and some results had blank responses. In addition, we determined the Navy 

Component Program Manager did not perform sufficient reviews of all transactions. 

For example, she presented that a cardholder with three ATM transactions on the 

same day totaling over $420 at Riverwind Casino, Norman, Oklahoma were not 

for personal use. The cardholder was authorized M&IE of only $177.50 for the 

three day trip. The cardholder made the three withdraws on the first day. The 

casino was located in route to the TDY locations. We believe these excessive ATM 

withdrawals were a strong indicator of personal use and led us to question the 

sufficiency of the review. We returned the results to the Navy Component Program 

Manager for further review and request that she provide complete, sufficient 

results of the review to us no later than June 30, 2015. 

Recommendation 4 

We recommended that Air Force Component Program Manager complete a 

review of the casino transactions and provide the results of the review to us 

no later than April 8, 2015.

Management Comments Required 

The Air Force Component Program Manager provided the results of the casino 

transaction review in a spreadsheet on April 8, 2015. Due to the size and amount 

of data in the spreadsheets, we did not include them in the report. 
Finding 

DODIG-2015-125 │ 27

Our Response

The Air Force Component Program Manager provided results in a spreadsheet, 

and some results had blank responses. In addition, we determined the Air Force 

Component Program Manager did not perform sufficient reviews of all transactions. 

For example, he presented that a cardholder with two ATM transactions on the 

same day totaling $500 at Cache Creek Casino in Brooks, California were not 

personal use. The cardholder was authorized M&IE of only $123.75 for the two‐day 

trip. The cardholder had an additional ATM withdrawal of $40 at the casino in the 

same day, bringing the one day total to $540 from a casino for a 2 day trip. The 

cardholder was reimbursed $11 for the ATM fees charged on his excessive cash 

withdrawals at the casino. In addition, the cardholder had ATM withdraws at 

another casino about 2 weeks later for over $300. We believe these excessive ATM 

withdrawals and repeated use at casinos were strong indicators of personal use 

and led us to question the sufficiency of the review. We returned the results to 

the Air Force Component Program Manager for further review and request that he 

provide complete, sufficient results of the review to us no later than June 30, 2015.

Recommendation 5 

We recommended that U.S. Marine Corps Component Program Manager 

complete a review of the casino transactions and provide the results of the 

review to us no later than April 8, 2015.

Management Comments Required

The U.S. Marine Corps Head of Audit Coordination, responding for the U.S. Marine 

Corps Component Program Manager, provided the results of the casino transaction 

review in a spreadsheet on April 13, 2015. Due to the size and amount of data in 

the spreadsheets, we did not include them in the report. 

Our Response

The U.S. Marine Corps Component Program Manager provided results in a 

spreadsheet, and some results had blank responses. In addition, we determined the 

U.S. Marine Corps Component Program Manager did not perform sufficient reviews 

of all transactions. For example, he presented that four ATM transactions totaling 

over $580 at Ultron Processing, in Kansas City, Missouri by three cardholders on 

the same night were not personal use. The cardholders had a combined M&IE of 

$274.50. We believe these excessive ATM withdrawals were a strong indicator of 

personal use and led us to question the sufficiency of the review. We returned the 

results to the U.S. Marine Corps Component Program Manager for further review 

and request that he provide complete, sufficient results of the review to us no later 

than June 30, 2015.
Appendix

28 │ DODIG-2015-125

Appendix

Scope and Methodology

We conducted this performance audit from August 2014 through February 2015 

in accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and conclusions 

based on our audit objectives. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit objectives.

From July 1, 2013, through June 30, 2014, DoD cardholders used their cards to 

make approximately 20 million transactions totaling $3.4 billion. Although we 

identified other questionable merchant categories, we focused the audit on casinos 

and adult entertainment establishments because we believed there was a higher 

risk for personal use due to the nature of the businesses. We used Internet sources 

to obtain listings and directories of known casinos and adult entertainment 

establishments. We used the merchant names on those listings to identify 

DoD GTCC transactional data that occurred at casinos and adult entertainment 

establishments. Specifically, we used separate queries in the Visa IntelliLink 

Compliance Management system and identified: 

• a universe of 24,119 GTCC transactions by 13,575 cardholders at 

U.S. casinos with a total value of $3,261,727; and 

• 900 GTCC transactions by 646 cardholders at adult entertainment 

establishments with a total-dollar value of $96,576. 

For transactions at casinos, we developed a detailed methodology and applied 

filters and tests to the universe to eliminate transactions that were not an indicator 

of misuse (such as for a hotel stay or meal at a casino restaurant while on official 

travel). Specifically we eliminated transactions under $100 and then tested for the 

following indicators of potential personal use:

• employee not on DTS orders at the time of the transaction;

• ATM withdrawals greater than total-trip per diem;

• multiple ATMs or purchases over $100 in the same day;

• quasi-cash transactions;

• transactions in a state other than the cardholders home state or 

the TDY state;

• more than four transactions over $100 in a week; or

• more than three ATM transactions in a week.
Appendix

DODIG-2015-125 │ 29

Also indicators of potential personal use, the following required at least one other 

indicator to be considered as potential personal use:

• ATM withdrawals over $300; 

• ATMs in the same state as cardholder residence;

• transactions on a holiday; or

• transactions greater than two times the total lodging amount for the trip.

As a result of the 11 tests and filters above, we determined that 4,437 transactions 

by 2,636 cardholders totaling $952,258, at casinos were high risk and likely for 

personal use.

We nonstatistically selected seven cardholders for further analysis. These 

cardholders were selected for different reasons, including: the number of 

transactions, location of the transactions, multiple adult entertainment 

establishments or the use of casino processing companies. We also covered all 

Military Services and one Defense Agency. For these cardholders, we reviewed 

additional transactions beyond the July 1, 2013, through June 30, 2014, scope 

to determine whether there was prior or subsequent abuse. We also provided 

a complete listing of the transactions that appeared to indicate personal use 

of the GTCC to the CPMs at each Military Service for their review and action 

as appropriate. 

In addition to the individually billed travel cards, the DoD Travel Card 

Program has centrally billed accounts (CBAs). From July 1, 2013, through 

June 30, 2014, DoD used CBAs to make roughly 2.5 million transactions totaling 

approximately $899 million. We reviewed DoD CBA transactions to identify 

any personal use of the CBA. We performed a query of all CBA transactions and 

identified 78 transactions at U.S. casinos totaling $517,111 but did not identify 

any CBA transactions at adult entertainment establishments. We reviewed 

five CBA accounts with 42 transactions at casinos totaling $489,203 and found that 

the transactions were proper and were not for personal use at a casino. 

We interviewed: 

• DTMO personnel; 

• CPMs and APCs at each Military Service; and 

• Citibank information technology staff managing the DoD travel 

card program. 

We reviewed public law, the DoD FMR, and DTMO and Component‐level 

guidance related to cardholder use and management oversight of Government 

travel charge cards. 
Appendix

30 │ DODIG-2015-125

Use of Computer-Processed Data

We used computer-processed data from Visa IntelliLink Compliance Management, 

Citi Electronic Access Systems, and DTS. The data we obtained were sufficiently 

reliable for the purposes of our audit, and we established data reliability based on 

the following information.

We used Visa’s IntelliLink Compliance Management system to access Visa 

transactional data. Visa has extensive security standards that require 

merchants and issuers (banks) to comply with an industry standard known as 

the Payment Card Industry (PCI) Data Security Standard (DSS). According to 

Visa, all entities that store, process, or transmit Visa cardholder data—including 

financial institutions, merchants and service providers—must comply with PCI DSS. 

The PCI Security Standards Council oversees the security standards that include a 

compliance program for: 

• assessing controls; 

• reporting or validating controls, or both, are in place; and 

• monitoring or alerting, or both, of existing controls. 

The PCI DSS certification for Visa IntelliLink Compliance Management was valid 

through December 31, 2014. 

An independent service auditor reviewed Citi’s technology infrastructure in 

a 2013 Service Organization Control (1) Report. The auditor determined the 

controls were suitably designed to operate effectively and provided reasonable 

assurance that the control objectives were achieved and operated effectively. 

Calendar year 2013 includes the first 6 months of our audit scope (July 2013 

through June 2014). To establish further assurance, we reviewed additional data 

queried from a broader time period from January 2011 through September 2014. 

We compared cardholder transactional information obtained from Citi and Visa 

that did not find any reliability issues. 

In 2013, DLA completed a readiness review of DTS system controls and 

subsequently asserted on December 11, 2013, that the DTS information technology 

system control activities were ready for audit. Because the audit of DTS had not 

yet been conducted (scheduled for FY 2015), we verified DTS information we 

obtained (travel-order dates and voucher expenses) to other sources as appropriate 

to establish its reliability. 
Appendix

DODIG-2015-125 │ 31

Use of Technical Assistance

The team met with the Quantitative Methods Division and discussed their approach 

during the planning phase of the audit. 

Prior Coverage 

During the last 5 years, we did not identify any audits related to DoD travel card 

personal use at casinos or adult entertainment establishments. 
Management Comments

32 │ DODIG-2015-125

Management Comments

Director, Defense Travel Management Office
Management Comments

DODIG-2015-125 │ 33

Director, Defense Travel Management Office (cont’d)
Management Comments

34 │ DODIG-2015-125

Director, Defense Travel Management Office (cont’d)
Management Comments

DODIG-2015-125 │ 35

Director, Defense Travel Management Office (cont’d)
Management Comments

36 │ DODIG-2015-125

Director, Defense Travel Management Office (cont’d)
Management Comments

DODIG-2015-125 │ 37

Deputy Assistant Secretary of the Army 

(Financial Operations)
38 │ DODIG-2015-125

Acronyms and Abbreviations

Acronyms and Abbreviations

APC Agency Program Coordinator

ATM Automated Teller Machine

CBA Centrally Billed Account

CPM Component Program Manager

DLA Defense Logistics Agency

DTMO Defense Travel Management Office

DTS Defense Travel System

FMR Financial Management Regulation

GSA General Services Administration

GTCC Government Travel Charge Card

M&IE Meals and Incidental Expenses

MCC Merchant Category Code

TDY Temporary Duty
Whistleblower Protection

U.S. Department of Defense

The Whistleblower Protection Enhancement Act of 2012 requires 

the Inspector General to designate a Whistleblower Protection 

Ombudsman to educate agency employees about prohibitions 

on retaliation, and rights and remedies against retaliation for 

protected disclosures. The designated ombudsman is the DoD Hotline 

Director. For more information on your rights and remedies against 

retaliation, visit www.dodig.mil/programs/whistleblower.

For more information about DoD IG 

reports or activities, please contact us:

Congressional Liaison 

congressional@dodig.mil; 703.604.8324

Media Contact

public.affairs@dodig.mil; 703.604.8324

Monthly Update 

dodigconnect-request@listserve.com

Reports Mailing List 

dodig_report@listserve.com

Twitter 

twitter.com/DoD_IG

DoD Hotline 

dodig.mil/hotline
DEPARTMENT OF DEFENSE │ INSPECTOR GENERAL

4800 Mark Center Drive

Alexandria, VA 22350-1500

www.dodig.mil

Defense Hotline 1.800.424.9098