A former Wachovia Bank executive who had handled insider fraud incidents says banks are in denial about just how massive the insider threat problem is within their institutions. Meanwhile, the economic crisis appears to be exacerbating the risk, with 70 percent of financial institutions saying they have experienced a case of data theft by one of their employees in the past 12 months, according to new survey data.

Shirley Inscoe, who spent 21 years at Wachovia handling insider fraud investigations and fraud prevention, says banks don't want to talk about the insider fraud, and many aren't aware that it's an "epic problem."

"There needs to be more training around this issue," says Inscoe, who co-authored a book about bank insider fraud called Insidious -- How Trusted Employees Steal Millions and Why It's So Hard for Banks to Stop Them, which publishes later this month. "We are seeing a huge increase in this country of organized crime rings threatening individuals who work in financial institutions and making them [commit fraud on their behalf]," she says.

Meanwhile, according to a new survey by Actimize, nearly 80 percent of financial institutions worldwide say the insider threat problem has increased in the wake of the economic downturn. "A significant number of folks are being impacted more than a couple of years ago," which is when the last survey was conducted, says Paul Henninger, director of the financial crimes product group at Actimize. The Actimize survey found that only 28 percent of financial institutions had not suffered an insider breach in the past 12 months.

"The severe recession has put these employees into a position to cross the line," he says.

Interestingly, it's not the stereotypical offshore or outsourced employee who's most risky to their organizations. Nearly 70 percent of financial institutions say their full-time employees are most likely to pose an insider fraud threat, versus 10 percent of part-timers, 8 percent of outsourced workers, 6 percent of temporary workers, and 5 percent of offshore employees, according to the survey.

Nearly 60 percent of the respondents in the survey ranked tellers and traders as the highest risk of insider fraud, followed by administrative/back office (55.74 percent), technology (34.43 percent), executive/senior management (29.51 percent), call center (29.51 percent), and line of business (26.63) employees.

The typical profile of the banker fraudster that Inscoe and co-author BC Krishna say typically commit these crimes is one of a bank's top performers, who is well-versed in its operations and how to circumvent them and remain under the radar.

But some security measures for limiting user access to sensitive data, such as minimizing user privileges, don't apply cleanly for banks. "What makes this problem interesting is that these employees need to have these privileges -- branch managers, customer service representatives, call center workers," Memento's Krishna says. "If you take them away, they can't do their jobs...a teller needs user privileges to go in and change an address, for example. It's impossible to implement dual controls -- you'd create customer service problems. The best thing they can do is proactively monitor and look for signs that user entitlements aren't being abused."

And in most insider fraud cases at banks, the employee has the motivation (think financial pressure, revenge) and the opportunity. Many of these cases start out with the insider intending to repay the money they moved or stole, Inscoe says. "In every situation I've been aware of, the person has been intending to repay the money, almost like a short-term loan they're giving themselves," she says. Unfortunately, the scam continues and the person never actually gives back the money, Inscoe adds.

Some banks are also missing a key element of the insider threat, too, she says. "Some are only focused on internal fraud if money is involved. I have a huge problem with that," Inscoe says. So if an employee is caught surfing customer data, they don't bother pursuing the case because no money was lost or stolen, she says.

"But for all they know the employee was selling that data to an external crime ring, incurring huge losses," she says. "And it breaks the customer's trust in their financial institution [if these cases are overlooked]. I have a real problem if banks say the only real insider fraud is if they see hard dollar loss."

'Should Have Been Caught Long Ago'
Nearly half of the banks in the Actimize survey say they are losing 1 to 4 percent of their total revenues to insider fraud, and the biggest challenges to meeting the threat are cost/expense (67 percent), data availability/access (55.77 percent), availability of tools (46 percent), and general resources/priorities (46 percent).

Inscoe and Krishna's book, meanwhile, explores several real insider fraud cases, including that of "Donna Lee Munson," a former assistant vice president of a bank in Georgia. The authors interviewed Munson (which is not her real name), who was convicted of stealing nearly $200,000 from her bank, in their book just prior to her serving her 18-month sentence at a federal prison. Munson transferred small amounts of money from bank customers' CD's to her own account over a period of time, with the intention to pay it back. "I never took any cash. Cash seemed wrong to me. Cash seemed like a tool of my job. But the paper part of it just seemed different," she said in the book interview.

Munson said her situation became so out of hand that she was unable to repay the money without arousing suspicion. Munson said banks should have better systems to catch employees like her who use their jobs to steal money. "They should have caught me a long time ago," she said in the interview.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.