In this case of employee theft our client sustained a loss approaching $1 million over a period of years through a staffer’s access to funds and accounts. Take note, there’s a cyber security lesson here concerning insider threats.
A transport and warehousing business with operations in the state capitals and a number of regional towns across Australia, our client appointed the employee to a position of trust, responsible for handling accounts payable to subcontractors.
Their key functions included
- checking and recording subcontractor invoices
- allocating the invoices to particular jobs
- arranging payments
- reconciling all subcontractor invoices.
This closed loop in operations enabled the employee to exploit the company’s online banking facilities and pay over $600,000 into a bogus subcontractor account of their own. An additional sum of more than $70,000 was also stolen, and our client incurred almost $150,000 in bank fees for resultant overdrafts.
Under the company’s management liability insurance the claim for the full amount of losses was settled within four months.
False billing accounted for 13,455 reported losses in the Australian Competition and Consumer Commission’s (ACCC) targeting scams report released in May 2018, a total sum of $2,796,980 in reported losses.
At a recent insurance webinar Ahmed Khanji, CEO of Gridware Cybersecurity, said his company’s statistics suggested insider threats were a bigger risk than malicious or criminal attacks.
And while most insider security threats are due to negligence or accident, a bad actor on the inside of a company is acting deliberately, exploiting vulnerabilities in the business’s systems.
How to pre-empt a malicious insider
What checks and measures could the client company have implemented to prevent the employee from getting away with stealing from them for so long?
According to the Australian Cyber Security Centre, there are a number of practices that companies can adopt to prevent insider threats.
Restrict access to a needs-only basis
Limit staff access to your networks to only what they need to do their job.
- Log, monitor and audit all transactions
If possible, have a separate team reviewing audit logs.
- Use unique logins to identify who is making transactions
And make sure your staff know that you are auditing and reviewing their actions.
- Control access and block network connectivity with non-approved devices
You know that scene in the movie where someone steals valuable information via a removable storage device such as a USB stick? Take steps to prevent it happening to your business.
- Monitor outbound emails and files
Implement a system to block and record outgoing emails with sensitive keywords or data patterns.
As this case study shows, a management liability policy protects your business and personal assets against losses resulting from employee misconduct.
Management liability is just one aspect of the comprehensive business insurance cover we can tailor to your individual requirements for all your operation’s needs.
If you would like to know more or discuss this further, please contact one of our experts.