The Insider Fraud That Bank Systems Miss

Bank fraud is no longer just an external cyber threat. Insiders with legitimate access can exploit banking systems, trusted credentials and institutional blind spots to quietly siphon money. The fraudster has the key, a designation, and years of institutional trust.

The core banking solution (CBS) has digitised every branch. It has also handed the insider an invisible weapon: the ability to debit accounts, backdate entries, park funds in suspense accounts, activate dormant accounts and move money to relatives or mule accounts. The fraudster takes advantage of late generation of activity reports and the lack of staff strength to scrutinise entries immediately.

Bank staff fraud cases have fallen from 2,624 in FY21 to 1,935 in FY25, and 400 in the first half of FY26. Staff fraud is only 8% of total cases but likely much higher in value. The decline in numbers suggests that existing controls such as maker-checker, job rotation and whistleblower schemes are working. But more needs to be done.

CBS eliminates manual errors and enables real-time, branch-agnostic processing. It has succeeded on both counts. The same architecture that lets a customer transact from any branch also lets a bank employee debit multiple accounts, credit funds to an account in a different bank, and route the proceeds to mule accounts. Once that is done, recovery becomes difficult.

The most technically dangerous method exploits 'value dating', the principle that interest accrues from the date of credit entry and not the actual transaction date. A staff member can post a backdated credit, square off the entry on the date of creation, let the system calculate and credit interest for the intervening period, then reverse the principal while leaving the already-credited interest untouched. Since each debit is matched by a same-day credit reversal, it may escape routine exception reports. Losses accumulate silently over years.

Inter-branch office and suspense accounts can also be abused. Funds can be fraudulently parked in such accounts and squared off before the end-of-day cycle closes. System logs capture every user ID involved in both schemes but exception reports are typically only reviewed during periodic inspections, not continuously. This gives the insider a wide window of opportunity.

Banks need to shift from annual audits to automated red-flag rules on the CBS/anti-money laundering layer that fire instantly instead of waiting for the periodic review. Biometric login into the system should be non-negotiable. Single biometric identity should not be allowed to play the role of maker and checker of the same transaction. No ID should be allowed to remain active for more than 15 minutes if not used. This will minimise the risk of login password-sharing by higher authorities.

All banks must make use of user and entity behaviour analytics (UEBA) to baseline normal activity per employee and flag deviations in near-real time. Structural controls include adoption of the four-eye principle, which requires at least two distinct authorised people to review and approve a critical action before it takes effect. No single employee can open an account, disburse a loan or execute an RTGS transfer alone.