Fortune 500 Bank Prevents Insider Fraud

Executive Summary

A Fortune Global 500 multinational bank with over 220,000 employees and 40 million customers needed a way to accurately identify possible instances of insider fraud. After discovering that corrupt employees had copied sensitive customer account information using burner phones — fraud that went nearly undetected — the bank turned to Teramind’s behavior analytics platform. By leveraging in-app field parsing, user and entity behavior analytics (UEBA), and scriptable rule logic, the bank built a custom insider fraud detection program that revealed data misuse, enriched threat intelligence, and achieved regulatory compliance.

Customer Profile

• Industry: Financial Services / Banking (Fortune Global 500)
• Workforce: 220,000+ employees
• Customer Base: 40 million customers
• Key Stakeholder: Senior Vice President of Fraud Prevention
• Primary Objective: Detect and prevent insider fraud involving sensitive customer data

The Challenge: Insider Fraud Hidden in Plain Sight

The bank discovered that some of its clients had fallen victim to insider fraud at the hands of corrupt employees who had copied customer account information using burner cell phones — actions that were nearly undetectable through existing security measures. Insider fraud of this kind can go on for years without discovery, and the bank knew the longer they operated without visibility into how employees interacted with sensitive data, the greater the risk of repeat incidents.

The core problem was that the most sensitive customer data lived inside individual form fields within a custom desktop application employees used daily to access customer accounts. The bank had no way to monitor activity at that level of granularity. Previous strategies produced inaccurate activity data and generated too many false positives for the threat intelligence team to act on effectively.

The bank faced three specific challenges:

• No oversight into how employees were working with sensitive data
• Inability to track sensitive data usage in custom applications
• Incident data lacked event context, making it impossible to triage or investigate effectively

As the bank’s Senior Vice President of Fraud Prevention put it: there was no analysis, no way to determine how much time was being spent looking at sensitive customer data, and fundamentally, no understanding of what was actually happening.

The Solution: Custom Insider Fraud Detection Program

The bank engaged Teramind looking for a custom solution that could provide the detailed, field-level data they needed. Working with a dedicated engineer and Customer Success manager from Teramind, the insider fraud detection program was built and launched using four key capabilities:

• In-App Field Parsing — Enabled the bank to track individual field-level activities across applications and websites, including their custom-built desktop app. This gave the fraud prevention team granular visibility into exactly which sensitive data fields employees were accessing and for how long.
• User and Entity Behavior Analytics (UEBA) — Established behavioral baselines for employee activity and detected anomalies that fell outside defined thresholds. When employees spent an unusual amount of time accessing sensitive fields, the security team was automatically alerted.
• Scriptable Rule Logic — Allowed the bank to create custom metrics to track any activity and build custom responses that automatically responded to unauthorized behavior, generating contextual forensic evidence in the process.
• Enterprise SLA & Professional Services — Provided dedicated, exclusive support and engineering resources to scope, build, and launch the custom solution.

Through this combination of capabilities, the bank could accurately assess how long employees needed to access sensitive data fields, identify which employees were exceeding typical access parameters, and use session recordings and reports to put excessive access activity into context before escalating incidents.

The Results

The implementation delivered measurable outcomes across fraud prevention, threat intelligence, and compliance:

• Gained visibility into field-level employee activity — For the first time, the bank could see exactly how employees interacted with sensitive customer data inside their custom applications.
• Enriched threat intelligence with irrefutable forensic evidence — Contextual activity data gave the fraud prevention team the evidence they needed to investigate and act on incidents with confidence.
• Streamlined incident triage with contextual activity data — Instead of sifting through inaccurate data and false positives, the team could quickly contextualize alerts and prioritize the right incidents.
• Built custom responses to thwart vulnerable employee behaviors — Automated rules and responses addressed risky behavior before it could escalate into fraud.
• Created an insider fraud mitigation program that accounted for user behaviors — The bank moved from reactive damage control to a proactive, behavior-driven fraud prevention strategy.

Critically, the solution also helped the bank meet its regulatory commitments. As a bank compliance executive noted, the ability to specify exactly what data to capture and have the system deliver accurate results was a major factor in achieving regulatory compliance.

Why Teramind

The bank’s Senior Vice President of Fraud Prevention highlighted that Teramind was compatible with all of their systems, operated automatically and non-invasively, and — most importantly — delivered completely accurate parsing technology. This accuracy was the differentiator that previous strategies had failed to provide, and it gave the fraud prevention team the reliable foundation they needed to build an effective insider fraud program.

The Verdict

For financial institutions handling sensitive customer data at scale, this case study demonstrates how Teramind can go far beyond traditional employee monitoring. By combining field-level parsing, behavioral analytics, and custom rule logic, the bank transformed its approach to insider fraud — moving from a reactive posture with no visibility to a proactive, evidence-driven program that protects 40 million customers and satisfies regulatory requirements.