Do Tough Times = A Rise in Employee Fraud?
11 March 2009
Jacob Jegher
Tough times bring about some pretty unfortunate acts. Disgruntled employees are a huge risk as they can do quite a number on bank assets and customer information. There is no doubt, the number of internal fraud incidents we are hearing about these days are on the rise. It's unfortunate but true. However, internal fraud is not a new challenge - it is a problem even in the best of times. We just don't hear about it as often when times are good. Insider fraud accounts for approximately 60% of bank fraud cases where a data breach or theft of funds has occurred. That is a staggering figure. No bank is immune to the risks presented by disgruntled employees and professional criminals. There are however, multiple steps that banks can take to better protect themselves and stay a step ahead of fraudsters. Given how serious the consequences of fraud can be, banks have to be quite particular about the policies and procedures they put in place. The breadth and depth of fraud solutions are of the essence, as banks must protect their physical and logical assets. In order to block and prevent potential internal fraud, banks should limit the use and display of social security numbers. They should also set policies regarding the use of personal digital storage (e.g. MP3 players, digital cameras, etc.) at the workplace, in addition to developing and adhering to a sound and timely notification process, and requiring ongoing security awareness and training. I have spent a fair amount of time researching this subject, and as you may imagine, have heard some pretty wild stories about insider fraud at banks (confidential of course). I invite you to read my report "Internal Fraud: Big Brother Needs New Glasses" if you would like to learn more about this subject and what banks can do to protect themselves.
Great topic, and one that deserves as much attention (and probably more) as it is getting these days. One of the difficult aspects of bank fraud prevention efforts– especially employee fraud – is measuring the value it delivers. If you catch fraud early, when actual losses are small, the “value” (in traditional ROI terms) is low. This makes investment in critical capabilities difficult to justify. But isn’t catching fraud early, before losses get big, the ultimate goal? An illustrative example is the recent internal case of a ex-bank manager stealing tens of millions from foreign customers over a period from the mid '90's to 2008, http://www.miamiherald.com/banking/story/867431.html.
To overcome this paradox, banking as an industry needs a more consistent way to measure potential losses and damages for schemes that are either caught early and/or involve information or identity theft where no funds are stolen. The value challenge is particularly tough for employee fraud, where many of the schemes start off as small dollar infractions (e.g., fee reversals, self-dealing) or involve the theft of sensitive information. I’d be interested in what Celent has to say about the value of employee fraud prevention in this context.