Aneicia Ford worked from home in a credit union's contact center between May and August 2022. Within weeks of starting she was passing data on some 23 customers to a ring that used false IDs to take over their accounts. The ring stole about $345,014, and the credit union made every account holder whole. Ford was sentenced to 30 months on 4 December 2025 (USAO W.D. Wash.).
What is insider fraud, and who counts as an insider?
CERT's 2012 study of insider fraud in US financial services defines the malicious insider as "a current or former employee, contractor, or other business partner who has or had authorized access" who "intentionally exceeded or misused that access" (Insider Fraud in Financial Services, p. 1).
Under its types table, what fraud is treats internal or occupational fraud as the kind staff commit against their own employer. Insider fraud reaches past that line, to contractors, agents and partners.
12 CFR 353.3 makes banks the FDIC supervises report insider abuse by directors, officers, employees, agents and other institution affiliated parties. In England, Wales and Northern Ireland, Fraud Act 2006, section 4 looks at the position held, whatever the job title. It covers a person "expected to safeguard, or not to act against," another person's financial interests who "dishonestly abuses that position", intending a gain, a loss or the risk of a loss.
Is an insider threat the same as insider fraud?
No. CISA defines an insider threat as the threat that an insider will use authorized access, "intentionally or unintentionally, to do harm", and counts "a contractor, a vendor, a custodian, or a repair person" among insiders. Fraud is the dishonest part of that risk. Picture two clerks: one clicks a phishing link, which is a threat; the other sells the member file, which is fraud.
How does an insider help a fraud ring?
In Ford's case she supplied the data and checked which accounts were worth hitting; the ring did the account takeover and the cash out.
Table 1. How an insider and a fraud ring split the work (Ford case; detection shares from CERT, 2012, cases with a known method).
| Stage | What the insider does | What the outsiders do | What the firm can see | Who can catch it |
|---|---|---|---|---|
| Access | Joins a role that sees customer data, from home | Nothing yet | A new hire with a full customer view | Hiring manager and access owner |
| Look up | Checks targets' balances, age and profession | Nothing yet | Look ups in the access log | Access log review |
| Hand over | Passes personal data to the ring | Make false IDs | Nothing in core systems | Colleagues, if they notice |
| Take over | Nothing further | Get new debit cards and higher ATM limits | Card reissues and limit increases | Branch staff, fraud monitoring |
| Cash out | Nothing further | Withdraw up to $25,000 cash; buy cashier's checks | Large branch withdrawals | Fraud monitoring, account holders |
| Detection | Leaves a trail in the access log | Nothing further | Complaints, audit findings | Audits 41%, complaints, colleagues and similar 39%, software 6% (CERT) |
From Ufuk Gürdaş, reviewer of this entry: "Look for the insider in the access log, not the payment ledger: in the Ford case the credit union's own electronic logs showed her accessing the victims' accounts on multiple occasions, while the ring made the withdrawals."
What forms does insider fraud take?
Caeshara Cannon, a member service representative at SEFCU, gave a ring customer account data for counterfeit checks that were presented at its branches. The conspiracy netted $88,800, and she was sentenced to 16 months (USAO N.D.N.Y., 22 October 2024). Her ring also applied for loans in stolen names, where insider data theft meets identity fraud.
Table 2. Types of insider fraud (ACFE: 2,402 cases of fraud against the employer, 2024 to 2025).
| Type | How it works | Source |
|---|---|---|
| Data theft for outsiders | Staff pass customer data to a ring; ACFE files misuse of confidential customer information as noncash misappropriation | Ford; Cannon; ACFE 2026 glossary, p. 106 |
| Collusion | Two or more people acted together in 49% of ACFE cases; median loss $324,000 with three or more, against $55,000 for one person | ACFE 2026, p. 63 |
| Record tampering | Falsified records; file maintenance entries made without independent review | FDIC module, p. 7 |
| Payroll and expense schemes | Paying oneself through payroll (10% of ACFE cases) or expense claims (13%) | ACFE 2026, p. 15 |
| Embezzlement | Taking money one was trusted to hold; bank staff face up to 30 years, a $1,000,000 fine, or both (one year at $1,000 or less) | 18 U.S.C. 656 |
What does insider fraud look like inside a bank?
The FDIC's examination module adds lending schemes: nominee loans built to get around lending limits, loans to companies in which an insider has an undisclosed interest, bribes and kickbacks on loan origination, and fictitious loans (FDIC, Insider Fraud and Abuse, October 2021, p. 5). Insider fraud "often" comes from "poorly designed controls and weak governance" (p. 1). Ford and Cannon were both prosecuted over a bank fraud conspiracy.
What warning signs does an insider leave behind?
Ford's trail sat in the access log, which showed her in the victims' accounts on multiple occasions. The FDIC module's signs "may include" falsified records and "file maintenance entries made without review by an independent party" (p. 7). No sign proves fraud alone:
- Lifestyle. "Unusual or lavish lifestyles" of staff (p. 2).
- Small events over months. CERT's frauds ran 32 months on average before anyone detected them (p. 3).
- One login for everyone. Poor practice in the FSA's 2010 small firms review: an adviser whose staff all shared one computer login (FCTR 10.3.17).
When is insider fraud a crime in the US, UK and EU?
Only FCG 4.2.1, which is guidance, names insider fraud. Cases go through fraud, bank and computer statutes; US bank rules add a duty to report.
Table 3. Which laws reach insider fraud, by jurisdiction.
| Where | Rule | Covers | Maximum |
|---|---|---|---|
| United States | 18 U.S.C. 1344, bank fraud | A scheme against a financial institution, carried out or attempted knowingly, to defraud it or to get money or property it owns or holds through false pretenses | Prison for up to 30 years, a fine of no more than $1,000,000, or both |
| United States | 18 U.S.C. 1030(a)(2), read with Van Buren v. United States (3 June 2021) | Intentional access without authorization, or exceeding authorized access, to obtain information; the second limb "does not cover those who ... have improper motives for obtaining information that is otherwise available to them" | A fine, up to 1 year, or both; up to 5 years for commercial advantage or private financial gain, a criminal or tortious purpose, or information worth over $5,000; up to 10 years after a prior conviction (1030(c)(2)) |
| United States, banks the FDIC supervises | 12 CFR 353.3(a)(1) and (2) | A SAR on a suspected federal crime, whatever the amount, when the bank has a substantial basis for identifying an insider; $5,000 or more where another suspect can be identified | A filing duty; the section sets no penalty |
| England, Wales and Northern Ireland | Fraud Act 2006, section 4 (section 15(2) extends sections 1 to 9 to these nations) | Dishonest abuse, by act or omission, of a position where one is expected to safeguard another's financial interests, intending gain, loss or the risk of loss | On indictment, up to 10 years, a fine, or both; less on summary conviction (section 1(3)) |
| United Kingdom | Computer Misuse Act 1990, section 1 | Causing a computer to perform a function with intent to secure access the person knows is unauthorized | On indictment, up to 2 years, a fine, or both |
| Scotland | Common law fraud; embezzlement (Scottish Government) | Recorded as fraud (common law and statutory) and, under other dishonesty, as embezzlement | The classification sets none |
| United Kingdom | Economic Crime and Corporate Transparency Act 2023, section 199 | A large organization fails to prevent an associate's fraud meant to benefit it, or someone the associate serves for it; no (1)(b) offense where it "was, or was intended to be, a victim" (s199(3)) | A fine (in force 1 September 2025) |
| United Kingdom, firms in FCG 4's scope | FCG 4.2.1, guidance | Good practice: "enhanced vetting and closer scrutiny" of staff in high risk positions, and four eyes procedures | Guidance; no penalty of its own |
| European Union | Market Abuse Regulation (EU) 596/2014, Article 14 | Insider dealing, a market offense with a different victim and a different act | Article 14 sets none |
Section 4 needs no unauthorized access, while 1030 and the Computer Misuse Act turn on it. Under section 17(5) of that Act, access is unauthorized when the person is not entitled to control access "of the kind in question" and has no consent to it.
How is insider fraud different from employee fraud and embezzlement?
Employee fraud is fraud by staff against their own employer, and embezzlement is taking money someone was trusted to hold. Insider fraud covers both. It adds the contractor, agent or partner, and frauds whose victims are the firm's customers.
Table 4. Insider fraud and the terms it is confused with.
| Term | Who | What is abused | Who loses | Law (examples) |
|---|---|---|---|---|
| Insider fraud | Staff, former staff, contractors, agents, partners | Authorized access or a trusted position | The firm or its customers | Fraud Act s4; 18 U.S.C. 1344 and 1030 |
| Employee fraud | Staff | The job's trust, access or authority | The employer | Fraud and theft statutes |
| Embezzlement | Whoever was trusted to hold the money | Lawful possession | Its owner | 18 U.S.C. 656 (US banks); recorded under other dishonesty in Scotland |
| Insider threat | Anyone with authorized access | Access, intentionally or not | The organization | No single offense |
| Insider trading | Anyone dealing on inside information | Inside information | Other market participants | MAR Article 14; UK Criminal Justice Act 1993, section 52, up to 10 years on indictment (section 61) |
How do you prevent insider fraud, control by control?
- Vetting, then vetting again (HR). Background checks at hire, credit checks at intervals where the law allows (FDIC item 9), and enhanced vetting for high risk roles (FCG 4.2.1).
- Four eyes (operations heads). A second person checks the work (FCG 4.2.1).
- Access reviews (IT). IT access rights "appropriately assigned, reviewed, and managed" (item 30).
- Two weeks away (HR). An annual two week absence, with someone else doing the job and remote access switched off (item 31).
- Insider accounts (compliance). Monitoring of accounts staff own or can sign on (items 26 and 27).
- Logs read (fraud team). CERT found transaction, database or access logs used in 20 percent of the 62 cases with enough detail.
- The report (MLRO). A bank the FDIC supervises files a SAR on suspected insider crimes of any amount. In the UK, the NCSC sends fraud victims in Scotland to Police Scotland on 101, and those in England, Wales or Northern Ireland to Report Fraud on 0300 123 2040.
complead, formerly Sanction Scanner, makes fraud prevention software. It answers each session or payment with approve, decline, review or step up. The reason comes attached. Those fraud decisions run on the same engine as onboarding, screening, monitoring and investigation, so a customer ends up with one risk score where separate tools would give several.
The first takeover in Ford's scheme came days after she completed her training. Dangelo Roberts, who handed her stolen data to the others, was sentenced to three years in November 2025, and the credit union carried the full loss.
Related terms
- Employee fraud. Staff defrauding their employer.
- Account takeover fraud. A criminal controls a customer's account.
- Embezzlement. Misusing money one was trusted to hold.
- Payroll fraud. Unearned pay drawn through payroll.
- Bank fraud. A scheme against a bank or its funds.
- Identity fraud. Gain from another person's details.
