Guides / Buyer shortlist

Insider fraud at community banks and credit unions: catch fake loans and deceased-member theft before an exam or audit does

Informational only, not an endorsement.

This page is for a CEO, a COO, a BSA or fraud officer, an internal auditor, or a supervisory committee member at a community bank or credit union. The practical question is how you would catch an employee booking fake loans, or taking funds from a deceased member's account, before an audit or an exam does. On October 30, 2026, the NCUA said it had issued two conviction-based prohibitions. The release identifies each person as a former employee. CU Collector's November 2, 2026 article ↗ describes the two schemes and writes that the employees already had access. The NCUA release and the two orders do not describe the schemes. When a fact comes from CU Collector, Verafin, Abrigo, or NICE Actimize, the sentence names that source.

Listings are informational only. BankToolkit does not endorse, rank, or score products. Account takeover and other payment rails are in the fraud prevention guide. Inbound mule activity is in the money mule guide. What you can share with another institution is in the 314(b) guide. Check images, positive pay, and kiting are in the check fraud guide.

Not legal advice; confirm with counsel and your examiner.

BankToolkit is not your counsel and not a law firm. This is a plain-English reading of public sources. Each fact below names the source that states it. Nothing on this page assesses the controls at Doches Credit Union or Heartland Credit Union.

What NCUA announced on Oct 30, 2026

The NCUA press release dated October 30, 2026 ↗ says the agency issued two conviction-based prohibitions in October 2026. It says the individuals are permanently prohibited from participating in the affairs of any federally insured depository institution. It also says an order of prohibition prohibits a party from ever working for a federally insured depository institution. This page refers to the two people by employer and city, which is what the release gives besides the legal captions.

Fact A former Doches Credit Union employee (Nacogdoches, Texas) A former Heartland Credit Union employee (Springfield, Illinois)
Offense in the October 30, 2026 release Convicted and sentenced in the United States District Court for the Eastern District of Texas for credit union theft, embezzlement, or misapplication, 18 U.S.C. 657. Convicted and sentenced in the U.S. District Court for the Central District of Illinois for credit union theft or embezzlement, 18 U.S.C. 657, and bank fraud, 18 U.S.C. 1344.
Notice of prohibition Administrative order 26-0073-SR ↗, dated August 12, 2026. The order states the same offense and says the conduct was at Doches Credit Union, Nacogdoches, Texas. Administrative order 26-0071-WR ↗, dated October 19, 2026. The order states the same offenses and says the conduct was at Heartland Credit Union, Springfield, Illinois.

Both orders say the prohibition applies by operation of law under 12 U.S.C. 1785(d) and 1829. Without the prior written consent of the NCUA or the Federal Deposit Insurance Corporation, the person may not become an institution-affiliated party of any insured depository institution, otherwise participate in the conduct of its affairs, or own or control an insured depository institution. The orders say sections 1785(d) and 1829 impose criminal penalties that include imprisonment of up to five years, and that a knowing violation would subject both the person and the institution to the penalties in the statute. The orders say the statutes do not prohibit the person from being a member of a credit union, or a customer of a bank or savings association.

The release and the orders stop at the conviction and the prohibition. Fictitious loans, unauthorized refinances, and deceased-member accounts are not in those three NCUA documents. Those descriptions are in the next two sections, and they are CU Collector’s.

Scheme 1: fake loans and unauthorized refinances

CU Collector, November 2, 2026 ↗, describes the Doches matter. CU Collector says it is drawing on the U.S. Department of Justice and on federal court records reported by Credit Union Times. This page did not open the court docket or the Department of Justice release, so the scheme below stays attributed to CU Collector.

CU Collector, citing the Department of Justice, says the activity came under scrutiny in April 2023 when an auditor requested a sample of loans from the branch. CU Collector says the methods were: creating fictitious loans using members’ information; refinancing legitimate loans without the members’ knowledge or consent; misappropriating loan payments; and conducting unauthorized transactions on member accounts.

The NCUA release says the former Doches Credit Union employee (Nacogdoches, Texas) was convicted and sentenced for credit union theft, embezzlement, or misapplication. It does not describe those methods. This page does not restate dollar figures from CU Collector, and it does not assess Doches Credit Union’s controls.

Scheme 2: deceased-member accounts

The same CU Collector article describes the Heartland matter. CU Collector says a June 2025 federal indictment is the source for the conduct. This page did not open that indictment.

CU Collector says a former Heartland Credit Union employee (Springfield, Illinois), whose work included deceased members’ accounts, issued checks payable to himself and made cash withdrawals from 2022 to 2024. CU Collector says the transactions were presented as legitimate distributions associated with deceased members’ accounts.

CU Collector writes that the available records do not establish how many deceased members’ accounts were affected, how the transactions escaped detection for approximately two years, or what ultimately exposed the misconduct. This page does not fill those gaps.

The NCUA release says this former employee was convicted and sentenced for credit union theft or embezzlement and for bank fraud. The release and order 26-0071-WR do not mention deceased members’ accounts. That detail is CU Collector’s, from the indictment it cites. This page does not assess Heartland Credit Union’s controls.

Red flags your monitoring should catch

The list in this section is Verafin’s. It is from Verafin’s August 2, 2019 article, “6 Indicators of Employee Fraud for Financial Institutions” ↗. Verafin says it developed the list with its industry experts after working with institutions of varying asset sizes, and that putting the flags into transaction and account monitoring can help uncover internal risk. It is not an NCUA list, and it is not a finding about either credit union in the October 30 orders.

Verafin’s six indicators, paraphrased from that article:

  1. Unusual account access. Access without a legitimate business purpose, outside normal business hours, or from outside the institution’s geographic area.
  2. Excessive account access. Frequent access to, and monitoring of, a targeted account.
  3. Unusual posting. Transactions posted outside working hours, or posted hours after a customer visit to a branch.
  4. General-ledger movement. A general-ledger transfer to an employee’s personal account. Also, an unusual transfer to the general ledger from an inactive payer or from an elderly, vulnerable, or wealthy customer account.
  5. Transfers to an employee. A transfer from a customer account to an employee’s personal account. Verafin calls out transfers from inactive payers, elderly or vulnerable customers, wealthy customers, and customers who do not speak English.
  6. Excessive transfers or cash deposits into an employee’s personal account. Verafin gives excessive non-sufficient funds (NSF) credits to that account as the example.

Verafin then says financial institutions should consider how automated transaction monitoring can help identify these indicators. It says a financial-crime system can also give investigators tools to triage sensitive internal cases, manage case permissions, and report activity to law enforcement. Verafin does not name a separate employee-fraud product on that page. This guide does not invent one.

A match on this list is a reason to look. Verafin does not call any single indicator proof of fraud.

Controls that don’t need new software

The control list in this section is Abrigo’s, from its March 11, 2025 article, “How to prevent internal fraud at your bank or credit union” ↗. The article is general guidance. It does not discuss the two NCUA orders. This page does not treat Abrigo’s check-fraud listing as an insider-fraud product. That listing is covered in the check fraud guide.

Four of Abrigo’s controls are process and access rules. They use the policy manual and the system you already run:

  • Separate initiation and approval. Abrigo says an employee who handles a financial transaction should not hold both the initiation and the approval.
  • Limit access by role. Abrigo says access to financial systems should follow the job. In the same article, Abrigo says role-based access should limit a person to the data and systems the job needs.
  • Keep audit logs. Abrigo says a log of system changes and approvals makes unauthorized actions easier to see.
  • Require vacation, and rotate the job. Abrigo says mandatory time away, and periodic rotation, can expose work that depends on one person staying in the seat.

Abrigo also says institutions should embed controls in IT systems so unauthorized changes and data access are blocked, and it describes automated monitoring that flags unusual patterns. That part is software. It belongs with the tools section below, not with a claim that a new purchase is required before the four process rules can start.

Abrigo’s warning signs include unusual activity in dormant accounts. The article also lists loan-application fraud, in general terms, as employees falsifying loan approvals with customer identification. That is Abrigo’s example of a common type. It is not a description of the Doches case.

Read against the two schemes CU Collector describes, the same material suggests three questions for your own procedures. CU Collector says the cases point to independent loan verification, transaction monitoring, separation of duties, and extra oversight of estate distributions. In the next sentence, CU Collector says neither the NCUA announcement nor the court records it reviewed establishes that these institutions lacked all such controls. The questions below stop at that line.

  • Fake loans. Sample loan files, including a sample from one branch. CU Collector, citing the Department of Justice, says an auditor’s April 2023 sample is what brought the Doches activity to light. Keep origination and funding with different people, which is Abrigo’s initiation-and-approval split applied to a loan.
  • Unauthorized refinances. Confirm the change with the member, and require a second person on the refinance. That pairing is this page’s reading of the refinance method CU Collector describes. It is not a sentence in the NCUA orders.
  • Deceased-member accounts. Require two approvals before an estate distribution. Review accounts flagged deceased, and review payouts to a payee tied to an employee. Verafin’s list flags transfers from inactive, elderly, or vulnerable accounts to an employee. Abrigo flags unusual activity on dormant accounts. A deceased member’s account can sit near both flags. That is a monitoring question for your own book. It is not a statement about what Heartland Credit Union had in place.

Tools that say they monitor employee activity

This is a map of sentences on each vendor’s own page. It is not a ranking. Nothing in the table says a product meets a rule, satisfies an examiner, or would have caught either matter above. Confirm the wording in a demo, against the page linked here.

Other listings, including names you will see on the category pages, are not given an employee-fraud description on this page. Start with Fraud Prevention, BSA / AML, and Risk, Audit & Exam Prep. Risk, Audit & Exam Prep is the audit and exam-prep shelf. This page does not describe those listings as employee-fraud monitors.

Listing BankToolkit page What that vendor's own page says What to confirm in a demo
NICE Actimize NICE Actimize, on BSA / AML and Fraud Prevention The Employee Fraud page ↗ says the Employee Fraud solution detects fraudulent employee activity and violations of corporate policy, and that it monitors transaction patterns and access logs. The Internal Threats page ↗ says the same solution includes collusion and relationship discovery and peer profiling and behavioral analytics, and that it runs on the ActOne Intelligent Investigation Platform. Whether employee alerts are separate from customer alerts, and who on your staff can open an internal case.
Verafin Verafin, on BSA / AML and Fraud Prevention The August 2, 2019 article ↗ publishes the six indicators above. It says automated transaction monitoring can help identify them, and that investigators can manage case permissions on sensitive internal cases. The article does not name a dedicated employee-fraud product. Whether those indicators are in the monitoring you would buy, and who can see an internal case.
Abrigo Abrigo, on Fraud Prevention The March 11, 2025 article ↗ publishes the internal-fraud controls above. This guide uses that article as guidance. It does not claim a named Abrigo insider-fraud product. Which of Abrigo's controls are policy, which are already in the core, and which would be a separate module.

What we still cannot cite

  • Loss amounts, restitution, and fines. CU Collector prints figures and attributes parts of the Texas account to court records reported by Credit Union Times. The NCUA orders also state a statutory fine for violating the prohibition. This page leaves the dollar figures out.
  • Sentence length, prison time, and supervision terms. The NCUA release says each person was convicted and sentenced. It does not describe the sentence. This page does not add the detail from CU Collector.
  • Job titles beyond former employee. The October 30, 2026 release says former employee. This page stays with that, plus the city and the credit union.
  • A finding that either credit union lacked a named control. CU Collector says the NCUA announcement and the court records it reviewed do not establish that.
  • A dedicated insider-fraud product name on the Verafin article or the Abrigo article used here.
  • Employee-fraud claims for vendors other than the three pages in the table. Those listings stay on the category pages.
  • Prices, detection rates, and ranks.

Sources

Sources checked Nov 3, 2026.

Quick answers

What is an NCUA prohibition order?

The October 30, 2026 NCUA press release describes two conviction-based prohibitions. It says the people covered are permanently prohibited from participating in the affairs of any federally insured depository institution. The administrative orders say this follows by operation of law under 12 U.S.C. 1785(d) and 1829 unless the NCUA or the FDIC gives prior written consent. The orders also say the person may still be a credit union member or a bank customer. This is not legal advice.

How do employees create fictitious loans?

NCUA’s October 30, 2026 release does not describe the method. CU Collector’s November 2, 2026 account, citing the Department of Justice and court records reported by Credit Union Times, says a former Doches Credit Union employee (Nacogdoches, Texas) created fictitious loans with members’ information, refinanced legitimate loans without their knowledge or consent, misappropriated loan payments, and made unauthorized account transactions. CU Collector says an auditor’s April 2023 sample of branch loans brought the activity to light.

How do you protect deceased members’ accounts?

CU Collector, citing a June 2025 federal indictment, says a former Heartland Credit Union employee (Springfield, Illinois) handled deceased members’ accounts and, from 2022 to 2024, issued checks to himself and made cash withdrawals. CU Collector says the records do not show how that went undetected. Dual approval before an estate payout, and a review of deceased-flagged accounts and employee-linked payees, needs no new software. Confirm it with counsel and your examiner.

What are signs of employee fraud at a bank?

Verafin’s August 2, 2019 article lists indicators it says institutions can put into monitoring. They include unusual or excessive account access, posting outside working hours or hours after a branch visit, general-ledger transfers to an employee’s account, transfers from inactive, elderly, or vulnerable accounts to an employee’s account, and excessive non-sufficient-funds credits to an employee account. Verafin offers the list as its own. A match is a reason to look, not proof of fraud.

Can transaction monitoring catch insider fraud?

Verafin’s 2019 article says automated transaction monitoring can help identify the employee-fraud indicators it lists, and that investigators can manage case permissions on sensitive internal cases. NICE Actimize’s own pages say its Employee Fraud solution detects fraudulent employee activity and policy violations, and that it monitors transaction patterns and access logs. Neither page says a product would have caught either matter in this guide. Confirm the fit in a demo. This is not legal advice.