How to prevent embezzlement at a bank branch: four federal cases

To prevent embezzlement at a bank branch, make every unit of cash belong to one person, make every movement of it leave a record that person cannot alter, and make sure someone else reads those records: sole-access teller drawers, dual control over the vault, the ATM and every recount, daily proof against an independent control, a cumulative over-and-short record for each person who handles cash, surprise counts, and a required absence long enough for someone else to run the work. Four federal prosecutions of branch employees, summarized below, show what happens when one of those is missing or signed without being done. Botminds' ATM & Teller Balancing is agentic software for the daily part of that discipline: it ties every drawer and ATM to its records, keeps each person's differences over time, and puts every count, correction and agent finding on one trail that internal audit reads.

The cases are real; the U.S. Attorneys' offices that prosecuted them published what happened. They are named here by role and place, not by the people involved. The figure shows how long each scheme ran.

Four federal cases, and the same shape in each

In every case, cash left a drawer, a vault or an ATM, and something written made the books look whole: an entry, a balancing sheet, a count sheet or a customer's account. None of the schemes required sophisticated technology. Each required that the person taking the cash also controlled, or could direct, the record that should have shown it missing.

The details repay a close reading. At Pilot Mountain, the teller also used two elderly customers' accounts: when the 89-year-old asked her about suspicious activity on his account, she told him it looked fine. At Elk City, the three tellers "had access to the bank's cash vault" and "created false vault balancing sheets to conceal the missing cash" (U.S. Attorney's Office, Western District of Oklahoma, January 2018). That is collusion, the one thing dual control cannot stop by design. In Tampa, the officer whose duties included overseeing the ATM and the teller cash drawers "also embezzled $52,000 from the ATM at the financial center he managed" (U.S. Attorney's Office, Middle District of Florida, July 2025): the supervisor of the control was the person it needed to control.

What are common teller embezzlement schemes?

The FDIC's examination manual lists them at the head of its section on tellers and cash: "Lapping deposits (covering one day's shortage with the next day's receipts); theft of cash; excessive over and short activity; fraudulent checks drawn on customers' accounts; fictitious cash items; manipulation of cash items; and intentional failure to report large currency transactions or suspicious activity" (FDIC RMS Manual, section 4.2). The four cases add two to watch for at a branch: false entries between a drawer and the vault, and a customer's dormant or rarely checked account used as the hiding place.

The Federal Reserve's examination manual names where such items sit in the books. Beyond the cash items account, "most banks will have several sources of internal float in which irregular cash items can be concealed", including "debits purporting to represent currency or coin shipments" and "all aged and unusual items of any nature that might involve fictitious entries, manipulations, or uncollectible accounts" (Commercial Bank Examination Manual, section 2310.1). The suspense account guide covers the most common of those waiting rooms.

What is lapping in banking?

Lapping is covering one day's shortage with the next day's receipts, so that a theft is never visible on any single day. A teller who takes $500 on Monday credits Monday's deposits late, using Tuesday's cash, and repeats the pattern, carrying the gap forward. The FDIC describes the loan version too: an employee takes a payment and "covers the theft with payments from another loan customer or from advance (early) payments from the same customer".

Lapping beats daily balancing by design, because every day balances. It shows up in three places: in customers' deposits credited a day or more after they were made; in a person's over-and-short history, where differences appear and reverse; and when the person is away, because the gap can no longer be carried. That last point is the reason for the oldest control on the list.

Why do banks require two weeks of vacation?

Because embezzlement usually needs the embezzler at work. The FDIC's manual says banks "should have a policy that requires all officers and employees to be absent from their duties for an uninterrupted period of not less than two consecutive weeks", and explains why: "Such policies are highly effective in preventing embezzlements, which usually require a perpetrator's ongoing presence to manipulate records, respond to inquiries, and otherwise prevent detection" (FDIC RMS Manual, section 4.2).

The manual adds the condition that makes it work: the benefits are "substantially, if not totally, eroded if the duties normally performed by an individual are not assumed by someone else." A teller whose drawer is locked while they are away has taken a holiday, not a control test. The same logic applies to rotation, which the FDIC wants kept from the people being rotated until it happens. At Pilot Mountain, the elderly customer's question about his account went to the teller herself.

What is the penalty for bank embezzlement?

Under 18 U.S.C. 656, an officer, director, agent or employee of a federally insured bank who "embezzles, abstracts, purloins or willfully misapplies" its money "shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both"; if the amount "does not exceed $1,000", the maximum is one year (18 U.S.C. 656). The four sentences above, from a year and a day to 24 months, were far below that ceiling.

The bank has its own obligation, and it starts at the first dollar. The FDIC's suspicious activity report rule requires a report for "insider abuse involving any amount" where the institution "has a substantial basis for identifying one of the FDIC-supervised institution's directors, officers, employees, agents, or other institution-affiliated parties" (12 CFR 353.3(a)(1)); the NCUA's rule for credit unions uses the same words, "regardless of the amount involved in the violation". The guide to SAR thresholds for an insider covers the filing itself.

How is bank embezzlement detected?

By a count, a record or a question that the embezzler does not control. In the two cases that say how the theft surfaced, it was an audit that found a drawer out of balance and bank officials who found the vault and a drawer short. Examiners are not the first line: the FDIC is explicit that "uncovering fraud is not the primary reason examinations are conducted; however, examiners must be able to recognize fraudulent or abusive actions." The bank's own controls have to find it.

Surprise counts are the bluntest of those controls, and the FDIC's examination module is specific about how far they go: examiners check that vault cash is controlled and that every note is counted by surprise, down to opening the strapped packets (FDIC examination module, item 20; the count itself is laid out in surprise cash count). A strap labelled $2,000 that holds $1,800 is a shortage that every count which reads the label will miss. For the ATM, the same module asks "whether a bank representative is present during ATM maintenance", which matters when, as in Spokane and Tampa, the ATM is one of the places cash is taken from.

The Federal Reserve asks its examiners to check what happened afterwards: whether "defalcations and/or mysterious disappearances of cash since the preceding examination have been properly reported" (Commercial Bank Examination Manual, section 2310.3, item 10). A bank that cannot list its unexplained cash losses since the last examination has a records problem before it has a fraud problem.

Repeated differences below the recount threshold, referred to the people who can act

What controls stop teller theft?

The controls that would have changed each of the four cases are the ordinary ones, done for real. The checklist below sets them against the cases. None is new; what matters is whether each leaves evidence that the person it protects against cannot write.

How do auditors find cash theft?

They compare records the suspect controls with records the suspect does not. A teller controls their transactions and their count sheet; they do not control the cash recycler's log, the customer's slip image, the customer's statement, the vault's independent count or the general ledger entries posted by someone else. Every one of the four schemes worked by keeping the first set consistent; every one was exposed when the second set was read against it.

That is the comparison agents can make every day instead of at the annual audit. In ATM & Teller Balancing, the Trace agent lines up each drawer's cash movements with the recycler log and the slip images at the close, and the Pattern agent looks back 30 and 90 days on every drawer, teller, branch, machine and cassette, normalized by volume. It never infers intent, never disciplines anyone and never shows a referral to the teller it concerns; it drafts the referral for Branch Operations, and a person decides. The agents never view security video; they can only draft a request to the Security Officer.

One audit trail of people and agents, kept five years and read-only to the auditor

What ATM & Teller Balancing does against embezzlement, and what it cannot do

It fits the daily, record-heavy part of preventing embezzlement: tying every drawer close and ATM settlement to its records, explaining each difference, keeping every count as two attributed counts, aging every unexplained item in suspense, and keeping one trail of people and agents, retained five years from each item's close under the fictional bank's settings. It does not replace the controls that are physical or managerial: the vault's two combinations, the surprise count, the enforced absence, the hiring checks. And it cannot stop two people who agree to steal together; it can only make the records they would have to falsify harder to falsify unnoticed.

How the recount itself should be signed is covered in dual control in banking, and the record that shows a pattern in a person's differences in teller balancing. The full design, with every agent and its limits, is on the ATM & Teller Balancing page.

Questions people ask

How do small banks prevent embezzlement with few staff?

By using people outside the branch for the checks a small branch cannot staff: internal audit or a sister branch for surprise counts, someone outside the branch for reviewing over-and-short records, and enforced absence covered by a relief employee. Where one person must hold two roles, they should never be both counters on a recount or both maker and checker on a correction.

Is embezzlement by a teller always a federal crime?

At a federally insured bank, theft or embezzlement by an employee falls under 18 U.S.C. 656, with a maximum of 30 years for amounts over $1,000 and one year for $1,000 or less. State charges are also possible.

Does the bank have to report an employee who took a small amount?

The FDIC's and the NCUA's suspicious activity report rules require a report for insider abuse involving any amount when the institution has a substantial basis for identifying an employee. The decision and the report sit with the BSA officer; nothing about them appears on the employee's or a customer's view.

Do cash recyclers prevent teller theft?

They reduce loose cash and keep a log the teller cannot edit, which removes some opportunities and makes others visible. They do not cover the vault, transfers between tellers and the vault, or customers' accounts, which is where the Pilot Mountain teller hid her entries.

How long do branch embezzlement schemes run before detection?

No government or academic source publishes a figure for branch cash schemes in particular. In the four federal cases above, the schemes ran from about four months to about two years.