Insider Fraud
Employees, contractors and outsourced support agents who use legitimate access to commit, enable or sell transaction fraud, such as leaking data, changing accounts or approving their own payouts.
What it is
Most fraud programs are pointed outward, and insider fraud exploits that. An insider's actions are authorized by definition, and they often happen in the same tools fraud teams use to fix fraud. In many cases the insider is the person operating the controls.
Three insider roles matter for transaction fraud:
| Role | What they do | Example (conceptual) |
|---|---|---|
| Executor | Moves value directly | Issues refunds or reward credits to accounts they control; approves their own claims; edits payout destinations |
| Enabler | Removes a control for an outside crew | Resets MFA, changes the phone or email on a target account, approves a flagged transaction, whitelists a device, overrides a hold, leaks rules |
| Data source | Sells or leaks data used elsewhere | Exports customer PII, balances or account details used for targeted impersonation, ATO or ACATS Transfer Fraud |
The enabler and data-source roles are growing fastest, because external rings (Fraud-as-a-Service Ecosystem) actively recruit insiders, especially in large, distributed, outsourced support operations where pay is low, turnover is high, and agents have broad access. Look at SIM Swap and Port-Out Fraud (carrier insiders), Account Recovery Abuse (support-assisted recovery), and Case Study - TD Bank AML Failures (2024), where the bank's guilty plea involved laundering networks that were helped by complicit employees.
Scope boundaries. This note covers insiders in transaction fraud. Embezzlement, corporate AP fraud and financial-statement fraud are out of scope, as is the broader occupational-fraud literature. CISA defines insider threat broadly: anyone with authorized access to or knowledge of an organization's resources who misuses it, intentionally or not, including employees, contractors and vendors. That breadth fits this note, because it counts your BPO agents as insiders.
How it works
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Access | Agent views accounts with no associated ticket; high lookup volume on high-balance or older customers; access outside shift | Access logging and review (Insider Access Controls) |
| Enabling action | Contact change, MFA reset or device approval performed by an agent, followed within hours by login from a new device and a payout | Link agent actions to downstream customer events; treat agent-initiated changes as Account Change Events |
| Executing action | Manual credits, refunds, goodwill adjustments or claim approvals concentrated on a small set of beneficiary accounts; approvals just under authority limits | Maker-checker on value-moving actions; Promo and Reward Redemption Patterns, Dispute and Return History |
| Override | Holds released, alerts closed or rules disabled without documentation; override rates far above peers | Override monitoring; Rule Governance and Change Management |
| Beneficiaries | Payouts landing in accounts linked to the employee (shared device, address, bank, surname, IP) | Entity Link Analysis between employee and customer graphs |
| Aftermath | Customer complaints mentioning a "support agent" who knew too much; clusters of ATO victims who all contacted support | Complaint mining (Customer Contact Signals); victim-to-agent overlap analysis |
The main analytical step is to join the workforce data (who did what, when, in which tool) to the customer data (what happened to the account next). Most organizations keep those in different systems owned by different teams, and insiders operate in the gap between them.
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| Support-agent account changes for hire | External crew pays per change (email, phone, MFA reset) | BPO and outsourced support; banks, brokerages, crypto, rewards |
| Data exfiltration and sale | Lookups and exports of PII and balances; used for targeted impersonation | Any customer-data-rich business; see Impersonation Scams |
| Manual credit and refund abuse | Goodwill credits, reward adjustments, refunds to self or friends | Rewards apps, retail, marketplaces |
| Review and decision manipulation | Fraud analyst approves known-bad, closes alerts, or leaks rules | Fraud operations; see Fraud QA Program |
| Branch and teller | New accounts for mules; ignoring structuring; cash access | Banks; see Money Mules |
| Carrier insiders | SIM swaps for crews | Telecom, which then hits financial accounts |
| Advisor misconduct | Exploits client trust, often older clients | Brokerage; see Elder Financial Exploitation |
| Collusive insiders | Two or more insiders defeating maker-checker | Higher-value schemes; see Fraud Rings and Collusion |
Where it shows up
- Neobanks and Consumer Fintech: large outsourced support teams with account-change powers; fast payouts make enabled ATOs very profitable.
- Brokerage and Investing: support-assisted recovery and contact changes before Payout Redirection or ACATS Transfer Fraud; advisor misconduct with senior clients.
- Cashback, Coupons and Rewards: manual reward credits, receipt-review overrides, partner-team offer configuration. Any "adjust balance" button is an insider risk surface.
- Online Marketplaces: claim and refund approvals, seller-account reinstatements, payout holds released.
- Retail and Ecommerce: returns without receipts, gift-card activation, employee discount abuse.
- Payments and P2P: limit changes, KYC overrides, and mule account approvals.
Impact
- Severity per incident is often high, because insiders know exactly where the value and the blind spots are.
- Amplification: one enabler inside a support center can drive dozens of ATOs. One leaked dataset can feed months of targeted scams.
- Regulatory: banks and broker-dealers face supervision, BSA/AML and data-protection exposure (Regulation S-P for broker-dealers; see Broker-Dealer Obligations (FINRA and SEC)). FINRA's 2026 oversight report tells firms to apply least-privilege access, MFA and access reviews to both human and non-human accounts, to revoke vendor access when relationships end, and to include vendors in incident response testing.
- Trust damage: customers told "your data was leaked by our own agent" don't come back.
Red flags
- Agent-initiated account changes followed quickly by new-device logins and payouts → Account Change Events, Session Behavior Anomalies
- Lookups with no ticket, or lookups concentrated on high-value or older customers → Velocity Signals
- Manual credits, refunds or approvals concentrated on few beneficiaries → Promo and Reward Redemption Patterns, Dispute and Return History
- Links between employee identity and beneficiary accounts → Entity Link Analysis
- Complaints mentioning support staff, or ATO victims sharing a common support contact → Customer Contact Signals
- Transaction patterns that only make sense if a control was bypassed → Transaction Pattern Anomalies
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Insider Access Controls: least privilege, just-in-time access, field masking | Shrinks what any one person can see or do |
| Prevent | Maker-checker and authority limits on value-moving actions | Forces collusion, raising cost and detectability |
| Prevent | Customer Support Verification Protocols; account changes routed through customer-side confirmation | Agents can't change contact details on their say-so |
| Detect | Workforce analytics joined to customer outcomes; peer-group outlier detection | Finds agents whose touched accounts go bad at abnormal rates |
| Detect | Graph Analytics linking employees to beneficiaries | Catches self-dealing and friends-and-family schemes |
| Respond | Investigation protocol with HR and legal (Investigation Standards) in a restricted Case Management Systems space; access revocation; SAR where applicable | Insider cases have employment-law constraints and need need-to-know handling |
| Detect | Route agent-initiated changes on high-value accounts to independent Manual Review Queues; apply Withdrawal and Payout Controls after any staff-initiated contact or payout change | Breaks the enabler-to-cash-out chain |
| Govern | Vendor and BPO oversight; Fraud QA Program sampling of overrides | Extends controls to people you don't employ directly |
Emerging variants and adversary adaptation
- Open recruitment of insiders. Crews advertise for, and directly approach, support agents at banks, carriers and crypto platforms, offering payment per account change or data pull. Large distributed support organizations are the main target.
- Insiders as AI-agent operators. As support teams adopt AI copilots and agents that can take account actions, the "insider" increasingly includes non-human accounts with standing privileges. FINRA's 2026 report applies access-management expectations to both human and non-human accounts. See Agentic Commerce Fraud.
- Fake insiders. Deepfake and proxy candidates passing remote hiring processes to gain access. The IC3's 2025 report notes job interviews with signs of voice spoofing or deepfakes, apparently aimed at network access more than direct financial loss. See Generative AI and Deepfake Fraud.
- Hybrid with social engineering. Many "insider" incidents begin with an agent being socially engineered rather than corrupted. The control response (verification protocols, maker-checker) is the same either way.
Related mechanisms
- Account Takeover (ATO), Account Recovery Abuse, SIM Swap and Port-Out Fraud: what enablers make possible
- Fraud Rings and Collusion, Fraud-as-a-Service Ecosystem: the recruiters
- Money Mules: insider-opened or insider-tolerated mule accounts
- Refund and Return Fraud, Loyalty and Rewards Redemption Fraud: executor-style value extraction
- Elder Financial Exploitation: advisor and caregiver misuse of trust
Real-world examples
- Case Study - TD Bank AML Failures (2024): complicit employees helping money laundering networks move funds through a major bank
- Case Study - FTX Theft via SIM Swap (2022): SIM swap as an insider-adjacent control failure at a carrier
- Coinbase Form 8-K (May 2025): a threat actor paid several support contractors or employees outside the US to collect customer data, including ID images, balances and transaction history. The actor then demanded money. Some customers were socially engineered into sending funds. Coinbase estimated $180M to $400M in remediation and voluntary reimbursement. It's a clear case of an enabler insider: no staff member touched funds, but the leaked data powered impersonation scams.
- Case Study - Coinbase Support Insider Breach (2025): full write-up of the bribed outsourced support agents, vendor litigation and arrests through 2026
Sources and further reading
- CISA: Insider Threat Mitigation: definition of insider and insider threat, including contractors and vendors
- FINRA 2026 Oversight Report: Third-Party Risk Landscape: least privilege, MFA and access reviews for human and non-human accounts; vendor access revocation
- FINRA 2026 Oversight Report: Cybersecurity and Cyber-Enabled Fraud: account impersonation, cybercrime-as-a-service, monitoring and staff training
- FinCEN Financial Trend Analysis: Identity-Related Suspicious Activity (2021): "abuse of access" (insider abuse, corruption) as a BSA typology, about 76,000 reports and $48B
- FBI IC3 2025 Internet Crime Report: deepfake and voice-spoofed job interviews aimed at network access
- Coinbase Global, Form 8-K (filed May 15, 2025): bribed overseas support personnel; customer-data exfiltration used for social engineering; cost estimate
- ACFE Occupational Fraud 2026: A Report to the Nations: the broad occupational-fraud benchmark (2,402 cases; behavioral red flags and tip channels)