Sadly, credit union criminals are often long-term, once-trusted employees.

Employees with the most tenure typically cause the highest internal fraud losses because they can leverage greater knowledge, more access to funds, more authority and a higher level of trust throughout the organization, according to the Association of Certified Fraud Examiners' 2012 Global Fraud Survey.

In the credit union industry, experts say, it's imperative to keep a close eye on the coffers to prevent financial loss and reputational risk because the damage done by internal fraud can have a long, lingering impact.

“The potential for employee fraud should always be a concern for credit union officials and volunteers,” NCUA Board Chairman Debbie Matz stated in a recent press release.

Fortunately, Matz said, credit unions can take a proactive approach to prevent internal fraud and learn how to discover it quickly.

Click through to learn seven fraud-fighting tips from security experts.

1. Bump up the checks and balances.

A credit union without adequate checks and balances is a prime breeding ground for embezzlement and other forms of internal fraud, said Chris Marquet, founder of Marquet International Ltd. in Wellesley, Mass., a risk management firm that publishes an annual fraud report.

“Improving checks and balances or financial controls is the most important step to prevent internal fraud,” Marquet said. “That means credit unions must have multiple signatures on checks, random audits, separation of duties and close oversight.”

Many smaller institutions, where separation of powers is more difficult to achieve, have fallen victim to dishonest employees.

“I saw one case where the embezzler was the only employee of the credit union,” Marquet said.

In effort to decrease losses to the share insurance fund, the NCUA recently created a seven-part online series entitled “Deterring, Preventing and Detecting Employee Dishonesty.”

The videos were developed by the Office of Small Credit Union Initiatives in partnership with CUNA Mutual Group as part of the NCUA's efforts to minimize fraud, the agency said.

The first three episodes are posted on NCUA's YouTube channel and can be viewed here.

CUNA Mutual Group also posted several resources for CU Times' readers, including a report on “Controlling Employee Dishonesty Risks and a video by Jay Isaacson, vice president of commercial products for CUNA Mutual.

2. Boost board oversight.

Lack of adequate internal controls and board oversight enabled two employees at the $4.2 million Milledgeville Community Credit Union in Milledgeville, Ill., to steal more than $320,000 in separate incidents that spanned numerous years, according to a recent press release from the U.S. Attorney's Office.

By increasing efforts to identify fraud schemes, credit unions can help minimize liquidity risk and transaction risk, which can be caused by unauthorized loans, inaccurate financial reports and other fraudulent activity, the NCUA said.

To improve internal controls, credit union boards must enforce separation of duties, review employee and family member accounts, monitor file maintenance transactions and take other measures to boost oversight, according to security experts.

“Close oversight by the board is very important for credit unions that want to prevent internal fraud,” Marquet said. “It is key that operational staff understand that their actions will be scrutinized. While every credit union has a board, not all boards are active in effective oversight. Once again, if no one is watching the henhouse, the foxes may run wild.”

Boards have fiduciary responsibility to update records and to order audits, and many cases warrant a qualified fraud audit firm, according to the NCUA.

CUNA Mutual Group cautions credit unions to pay close attention to the Credit Union Bond (underwritten by CUMIS Insurance Society, Inc., a member of the CUNA Mutual Group), which stipulates that the bond's coverage for an employee or director terminates immediately when any director, officer or supervisory staff – not in collusion with the alleged criminal – learns of any internal fraud by employees or board members.

3. Set a zero tolerance fraud policy.

All credit union boards should draft a formal fraud policy, with the assistance of legal counsel, to address specific items, establish guidelines for investigations and explain consequences, according to CUNA Mutual and other risk management experts.

“Zero tolerance sets the tone from the top,” Marquet said. “Employees involved in misconduct should be disciplined – severely when we are talking about theft or threats, etc. Make sure everyone knows that the credit union operates with the highest standards applicable to all.”

When creating a fraud policy, one key ingredient is a written statement, which should be read and signed by all staff members during annual reviews, said Joette Colletts, senior manager of risk management at CUNA Mutual Group.

“It really sets guidance in case an embezzlement should occur in the credit union, and it really helps deter against employee dishonesty because you're requiring that that employee review it on an annual basis, and that they sign it and date it so they're acknowledging what they shouldn't be doing in a credit union,” Collette said in the NCUA video series.

The deterrent effect upon an employee, who is made aware of the policy on the first day of employment and periodically reminded that such a policy exists, cannot be underestimated, according to CUNA Mutual Group.

An employee's chances of successfully charging wrongful dismissal or malicious prosecution may be significantly reduced when the credit union can produce signed statements acknowledging an understanding of what is considered dishonest and unacceptable behavior, the organization said.

The policy should include guidelines for potential termination or suspension of dishonest employees and steps for notifying the appropriate law enforcement agency, regulatory agency and the bond provider, the organization said.

Factors to be considered include the nature of the offense, dollar amount involved, existing policies, effect on bond coverage, union restrictions, state laws and regulatory considerations, the organization said.

Even if a dishonest act does not result in a loss, the credit union should still report the activity to bond provider, CUNA Mutual Group said.

CUMIS reviews dishonest activities to determine if employees involved present an increased risk to the credit union bond, the organization said.

Depending on the crime, credit unions might have to file a Suspicious Activity Report, according to federal regulations.

If an embezzler makes financial restitution, the directors might not take action against the alleged embezzler, but failure to act may result in release of surety from liability for any future shortages and directors may be personally liable for losses sustained, according to the NCUA Guidelines.

4. Spot red flags.

NCUA's video series on employee dishonesty refers to “The Fraud Triangle,” which includes an employee's motivation, rationalization and opportunity to engage in criminal activity.

It's vital for credit union managers and board members to be aware of the numerous ways that employees can embezzle and learn how to spot potential risk, the NCUA said.

The most common forms of credit union embezzlement involve writing fictitious loans, issuing unauthorized loans to employees and family members, doctoring expense ledgers, pilfering deposits in transit, kiting, creating false or fraudulent statements and stealing from closed or dormant accounts, according to the NCUA's Examiner Guide.

In its Supervisory Committee Guide, the NCUA cautions credit unions to remain alert for common risk factors such as a lack of board approved policies for areas such as lending, investing, borrowing and operating expenses; lack of segregation of duties; lack of mandatory vacation policy; failure to maintain adequate audit trails; incomplete or inadequate audits or verifications; inactive supervisory committees; repeated record keeping problems and manipulated bank reconcilements.

Red flags for employee dishonesty can include attitude changes, not taking vacations, keeping records in disarray and lifestyle changes such as excessive spending or borrowing, the agency said.

5. Conduct surprise cash counts.

Surprisingly, audit procedures are not a normal part of the NCUA examination process, according to the agency's guidelines.

Although the NCUA provides guidance to federally insured institutions that discover a shortage of funds, credit union officials must take ultimate responsibility for providing adequate internal controls, detecting shortages and taking appropriate action, the agency said.

Surprise cash counts are necessary to ensure that dishonest employees don't have the ability to hide their crimes, according to the NCUA.

Credit union management should count cash in the presence of the employee responsible for the funds and all cash items should be included, Colletts said.

Teller funds, travelers' checks and ATM counts could be conducted on separate days, the NCUA said.

Cash bundles should also be broken down and cash totals should be verified with the general ledger, Colletts said

“It's important to break down the bundles because there have been cases where someone has replaced $100 bills in the center of a bundle with $1 bills,” she explained in the NCUA video.

If examiners suspect an internal shortage, they should expand the exam as necessary to determine if a shortage exists, according to the guide.

Following up on shortages is part of district management and it is the board's responsibility to take appropriate action, the NCUA said.

After discovering and documenting a pattern of potential fraud, the supervisory committee must investigate and resolve the shortage, the guidelines said.

6. Keep track of loans.

In most credit unions, examiners find it impossible to review all loan files for evidence of unauthorized or fictitious loans, but a random sample of loans may not uncover an illegal scheme, according to the NCUA.

In many recent cases of unauthorized or fictitious loans, embezzlers have created all loan documents and forged signatures.

One way to avoid fraudulent loans is to review for current payments, valid approval signatures and adequate share balances for share secured loans, according to security experts.

To conceal unauthorized loans, dishonest employees sometimes destroy member statements or change the mailing address to a post office box, their home address or the credit union's own address, the NCUA said.

To detect fraudulent loans, credit union boards should review loans, especially those made to employees or volunteers, to confirm validity of dates, signatures and collateral listed on loans, the agency said.

NCUA cautioned that red flags for fraudulent loans include listing a next payment due date that is more than 60 days in the future; having loans that are not reported as delinquent, but records indicate interest due; or accounts where the original and the current loan balance are approximately the same, although the payment schedule indicates that the current balance should be significantly less.

If suspicious activity is spotted, it's important to verify the borrower's name and address from non-credit union documents, such as telephone directories, certificates of title and sponsor records, the NCUA said.

Another simple step is to call the purported borrower to verify the accuracy of loan information.

7. Keep a close eye on member shares.

The NCUA encourages supervisory committees to review employee and director accounts as well as related family member accounts, bank statements and reconciliations.

Indicators of illegal activity include significant withdrawals or transfers, negative balances in accounts, the lack of non-sufficient fund fees or reversal of such fees, posting of drafts out of sequence and manual clearing of checks, the NCUA said.

Employees should not be performing transactions on family member accounts, the NCUA said, and dormant and closed accounts are frequently used to perform unauthorized transactions.

Credit union boards should compare records of inactive accounts from a year ago with current inactive accounts, and scrutinize member statements for accounts that do not appear on the most recent inactive list, the NCUA said.

If a suspicious withdrawal involves transfer to another account, officials should review the account and contact the member directly or by telephone to determine the legitimacy of the withdrawals, the agency said.

Credit union officials should use caution when they discover an instrument containing an apparent forgery of the name of a relative.

Frequently, these persons will claim that they gave permission for use of their names.

The negative share and share draft report should be examined at random times –instead of just at month-end – to uncover overdrawn amounts that dishonest staff may fix at the end of each month, the NCUA said.