Citi Case Exposes Insider Risks

"Internal Controls Could Have Detected Fraud Much Sooner"

On June 26, federal authorities arrested a former Citigroup executive for allegedly embezzling more than $19 million from Citi and its customers.

Gary Foster, who worked in Citi's treasury finance department, was arrested by the Federal Bureau of Investigation at John F. Kennedy International Airport, just as he returned from a trip to Bangkok.

The United States Attorney for the Eastern District of New York has charged Foster with bank fraud. If convicted, he could be sentenced to 30 years in prison.

The Foster embezzlement charge marks the second public blow Citi has taken in less than a month. Also in June, the bank revealed that its online banking platform, known as Citi Account Online, had been infiltrated by hackers. Personally identifiable information about hundreds of thousands of Citi customers was likely exposed.

Tom Wills, a fraud analyst at Javelin Strategy & Research, said in response to the online breach that banks are losing the fraud fight because they aren't focusing on the right things. "If Citi is wise, they'll do some serious reflection, and make sure this particular failure doesn't repeat itself."

Citi has provided few details about the case, but in an issued statement says it is "outraged."

"Citi informed law enforcement immediately upon discovery of the suspicious transactions and we are cooperating fully to ensure Mr. Foster is prosecuted to the full extent of the law."

Lack of Internal Controls
Shirley Inscoe, director of financial services solutions at Memento and a former risk management executive at Wachovia who authored "Insidious: How Trusted Employees Steal Millions and Why It's So hard for Banks to Stop Them," says Citi is not alone. Most banks have done a poor job of keeping up with internal threats.

"With the economic downturn, I think many banks have cut back on their internal controls and fraud detection because of very tight budgets," Inscoe says. "Any other bank could have just as easily been victimized." ...

Posted in: Internal Fraud Account Takeover Identity Theft