Searching by balance: how bribed bank insiders choose their targets

The week

Mid-May 2026 marked a year since a large US cryptocurrency exchange disclosed that criminals had bribed overseas support staff for customer data. Banks had their own cases moving through federal court. In February 2026, the Justice Department announced a guilty plea by a former TD Bank employee who had taken bribes to pass customer information to outside co-conspirators, who used it to take over accounts. On May 28, it announced a second former TD Bank employee’s plea. Prosecutors said he took at least $155,000 in bribes and used his position to find accounts with large balances. He shared those customers’ details with co-conspirators, and later bribed an employee at another institution to falsify records so an account could be opened. The department said he facilitated about $3.4 million in fraud losses. The conduct dated to 2021 and 2022.

Earlier in this series we looked at insider risk as a market, in which criminals price access against what an employee earns and risks. The 2026 bank cases show the mechanics. The bribed insider worked as a targeting service. Criminals did not need a bulk download. They needed someone who could find the few customers worth defrauding and then help the fraud clear.

That gives a bank three distinct things to control. They map to what an insider can do with legitimate access: find valuable customers, read what the screen reveals about them, and change records or open doors that should stay shut. Most insider programs concentrate on detecting a bad actor. Controls on finding, reading and changing reduce what any insider can sell, whether or not the bank ever identifies who was bribed.

Finding: the search that ranks customers by value

Prosecutors described an employee who used his position to identify accounts with large balances. In many banks that is easy. Branch and operations staff can often search customers by name, sort lists by balance, or run reports that surface high-value relationships. Those capabilities exist for good reasons, such as relationship management and service. They are also exactly what a fraud ring wants to buy.

The control is to separate ordinary lookup from value-based discovery. A teller serving a customer at the counter needs that customer’s record. It does not need a list of the branch’s largest depositors. Queries that filter or sort by balance, or that return many customers at once, should be limited to roles that need them. Those roles should run such queries through reports that are logged and reviewed. Access reviews usually ask which applications a person can open. They rarely ask which queries a person can run inside them, and that is the gap.

Query patterns also make good detection signals, because they are rare once access is narrowed. A front-line employee who opens accounts unrelated to any customer interaction, or who views several high-balance relationships in another branch, is unusual. Banks can tie record views to an active interaction, such as a call, a ticket or a counter transaction. Any lookup without one then stands out.

Reading: what each screen reveals

Once a target is found, the insider sells what the screen shows: name, address, phone, email, date of birth, account numbers, recent transactions, and sometimes security questions or identity document images. That combination lets a co-conspirator pass phone verification, reset online credentials or impersonate the bank convincingly. The data is the key that account takeover needs.

Most customer screens show far more by default than the task requires. A useful exercise is to list the ten most common front-line tasks and record what data each needs. Address changes need the current address. They do not need the balance. Balance inquiries need the balance, but not the full account number. Masking by default, with a logged and reasoned action to reveal a field, shrinks what a bribed employee can harvest in a day. It also limits exposure from malware on a workstation and from shoulder-surfing.

Authentication data deserves its own treatment. If staff can see the answers customers use to authenticate, then a bribed employee can sell the bank’s own verification process. Answers should be checked by the system, not displayed to the person asking. Identity document images collected at onboarding are best kept in a separate store that only a small verification team can open.

The same review applies to people outside the branch. Contact centers, back-office processing teams and outsourced providers often see the same screens as branch staff, at larger scale and with less local supervision. Their access should be scoped by task in the same way, and outsourcing contracts should require the provider to report suspected misconduct quickly and to support the bank’s investigation. Asking a provider for evidence of how it handled its last insider case says more than a policy document.

Changing: the overrides that open doors

The second scheme in the May plea shows the third capability. According to prosecutors, an employee at another institution was paid to falsify records so an account could be opened. Stolen funds need somewhere to land, and an account opened on false records is that place. Insiders who can override identity checks, waive documentation or edit customer details are therefore selling the exit route as well as the entry.

The controls here are older and better understood, but often eroded by convenience. Exceptions to identity verification at account opening should need a second person, and the second person should not report to the first. Changes to contact details, especially phone numbers and email addresses, should trigger a notice to the old contact point and a short hold on high-risk actions such as wire setup. Exception volumes should be reported by employee and branch, because a quiet rise in overrides is often the first visible trace of a paid insider.

Each of these controls has a cost in speed and customer convenience, and frontline managers will feel it. The trade-off is easier to defend when the bank shows where the friction falls: on value searches, sensitive reveals and overrides, rather than on every routine transaction. Banks should check with counsel on how employee monitoring interacts with privacy and employment law where their staff and contractors work.

With hindsight

From October 2026, the May plea was still awaiting sentencing, which the court had set for mid-October. The case adds to a run of insider prosecutions in which employees at large and small institutions sold customer data or account access. The crypto exchange case of 2025 drew more attention because of its scale, but the bank cases show the same economics at the branch and back office. The controls have held up as a sound frame. Query-level access and masking are product changes that depend on core and customer platforms. Whether a platform can restrict searches or fields that finely without customization or vendor work is a question to put to the vendor early. Override reporting is cheaper and can start immediately. Fraud teams that link account takeover cases back to the employees who viewed or changed the affected records are best placed to find the next insider.