Insider fraud is an uncomfortable truth of the banking and financial services industry, but discovery can be especially jarring at credit unions. Instead of being big, faceless for-profit institutions, credit unions are cooperatives built on the premises of trust.
From inception, community members pool their resources and extend trust to an elected board of directors, charged with the duty to oversee and safeguard the credit union. When this trust is broken, especially from the inside, the damage is pervasive and goes beyond simple monetary penalties. Several recent cases offer a useful window into how such breaches occur, and how we can evaluate and strengthen current safeguards in place.
As a first example, Daniel Johnson as CEO was able to leverage his position’s control over the loan process to circumvent soundness controls over a small ($8 million in assets) federal credit union in Virginia. He submitted two fraudulent loan applications, fabricated board authorization required by lending policy, and diverted around $300,000 to cover personal obligations. In another recent case, Jacqueline Burns worked as an account manager responsible for managing member records and monthly statements.
As a part of these duties, she identified accounts that had gone dormant and steadily withdrew funds while taking steps to prevent detection. Together, these represent over $500 thousand in entirely preventable losses; they serve to showcase the importance of assessing risk and designing controls.
These actions immediately follow the NCUA’s recently issued 2026 Supervisory Priorities, and they’ve continued to highlight fraud as a major concern. This year they noted an elevated risk for fraud, so credit unions can expect examiners will be reviewing the adequacy of controls with greater scrutiny. Examiners have already stated that this review will include analyzing the internal controls and separation of duties in place to address insider abuse. When thinking about and assessing internal controls, a credit union should watch out for the following areas of concern:
Credit unions should consider broader policy goals when developing controls. Accordingly, controls should be developed in a two-phase process. The first step is to understand the credit union’s vulnerabilities. The risk assessment should be the foundation for that step.
A simple way to think about it would be a departmental approach. In identifying and assessing internal fraud, consider how an employee could act nefariously, and what would stop them. This should identify roles that carry outsized exposure and expose gaps in controls that provide opportunities for insider fraud.
Aside from being inherently helpful, the risk assessment serves as the credit union’s support that its controls are risk-based and well-reasoned. The assessment is typically done every 12 to 18 months – to ensure the program is evolving, though particular events may warrant additional changes.
To illustrate this, consider a hypothetical case in which a call center employee abused weak security at their job site to steal physical account records. In this case, signature cards in a secure cabinet were able to be accessed with a key stored publicly. It would be possible for this employee to take cards out of the cabinet, copy private information to their phone to apply for credit elsewhere, stealing these members’ identities. To justify expenses to enhance security at their branches, this credit union should quickly update their risk assessment to document and show the need. They might be able to increase oversight by securing file access, investing in a dual-control key locker, and install additional cameras.
Additionally, an anonymous reporting system could be implemented to empower staff to report suspicious behavior without fear of retaliation. In times of crises like this, it’s important to take a step back and consider what more the credit union could have done. Taking a critical approach to ‘cleanup’ can be monumental in preventing repeat occurrences.
Now that we have a complete understanding, designing controls to address risks is to be considered and implemented on an individual basis. Implementing proper separation is heavily dependent on credit union size and complexity. Smaller and mid-sized credit unions may need to be more creative. Instead of simply augmenting staff, those credit unions may want to have departments perform internal audits for each other. While just one example, cross-auditing can be a simple way to ensure the entire credit union is held to the appropriate standard.
Additionally, while it would be less likely for a large credit union to have single person functions, staffing shortages or employee turnover are still realities which could present migration difficulties. This size of credit union may implement a compliance monitoring system to enhance accountability over the credit union’s processes; others may seek to implement detailed Quality Control (QC) processes and personnel. However, these approaches are dependent on the individual credit union. Credit unions will want to avoid thinking about this as a checkbox exercise.
The important part is to anticipate potential risks, document those risks, and determine how they will be managed. These controls should all be incorporated into a fraud prevention or similar board-approved policy to show effective oversight and further reasoning.
To put this all together, a credit union that wants to build or reassess its fraud prevention program should do so taking some basic steps:
Staying informed of fraud occurrences in the industry can be valuable in a similar way to post-incident reviews. Prevention is the key here; it’s much easier to learn from someone else’s mistakes than it is to unwind fraud occurring at home.
Want to know more or have questions? Contact us at compliancesupport@viclarityus.com.
For more information, email Lisa Quaranta.
Your League-member benefits include the Compliance Hotline — providing exclusive access to dedicated compliance experts:
Using the above phone number and email address, you can gain access to a knowledgeable team that’s ready to address all your credit union’s compliance inquiries — promptly and efficiently. With the Compliance Hotline, you can proactively respond to impromptu questions and issues by getting clarity and insight on technical topics that normally slow you down. We want to help you unlock the full potential of your League membership by leveraging the resources and support you need to navigate the complex world of compliance effortlessly. We’re ALWAYS just a phone call or email away!
Additionally, other League-member compliance resources include:
For more information, email Lisa Quaranta.
Powered by ViClarity, a California’s Credit Unions and Nevada’s Credit Unions company.
