A case of fraud occurred at a major German retail bank. In a so-called direct debit scam, a large number of direct debits were collected by a corporate customer for crediting from his account and transferred by express transfer to various bank accounts in Germany and abroad. Various control mechanisms at the bank failed. As a result, the fraud only came to light a few days later when the first returned direct debits were debited to the account.
Complex and confidential special investigation initiated immediately
The current interim manager was commissioned with a special investigation to be initiated immediately. The task was complex from the outset, as many areas were involved in the incident: from the processing of direct debit limits and payment execution to the credit approval of direct debit limits and the back office to the automated control of transactions.
As part of the investigation, the corporate client's account was initially blocked immediately. The interim manager called together the responsible managers from the legal departments and the Anti-Financial Crime department to obtain an initial assessment of the situation. At this point, it was not clear whether the perpetrator (the corporate client at the time) had accomplices in the bank who could have informed him about internal procedures or vacation and substitution arrangements, for example. The special investigation therefore had to be conducted in strict confidence - as is usual in most fraud investigations.
Banks and law enforcement authorities informed of suspected money laundering
When the special investigation began, the interim manager immediately reported a suspected case of money laundering to the Financial Intelligence Unit. At the same time, he initiated a criminal complaint with the criminal investigation department. His team forwarded the account transactions and other documents relevant to the investigation to the prosecution authorities. He also contacted several banks involved in the payment transactions and asked these banks to "freeze" the suspected corporate client's assets.
After initiating the immediate measures, the interim manager formulated his working hypothesis and made assumptions regarding the areas involved in the fraud. He drew up a chronological sequence of the money dispositions and began analyzing the process chain. This included, in particular, a review of the process documentation and procedures as well as the determination of vacation and substitution regulations and the responsibilities of the respective department heads.
Circle of suspects narrowed and personnel measures recommended
The results made it possible to narrow down the circle of suspects in the company. The interim manager questioned these employees in investigative interviews. This revealed that some managers and employees - partly intentionally, partly due to "sloppiness" - had allowed this fraud to occur. Various warnings, reprimands and the reallocation of responsibilities were the consequence.
Technical transaction monitoring analyzed and optimizations initiated
The bank's technical transaction monitoring had not triggered as expected despite the considerable scope of the fraud. The interim manager therefore analyzed the fraud monitoring system - and in particular the "red flagging" components that should have generated a warning message. He also interviewed the head of the anti-financial crime department. This revealed significant deficiencies in the programming and individual monitoring.
Final report with recommendations for restructuring
In his final report to the Management Board, the interim manager summarized numerous recommendations for fraud prevention and fraud management. These included adjustments to processes, the internal control system, transaction monitoring and suggestions for personnel measures. These ultimately led to the recommendation to restructure the affected areas.
