Employee fraud

A medium sized specialist professional services business started to become aware that they were repeatedly losing business to one of their rivals. There was no apparent reason for this change in practice and the specific customers leaving indicated that it was most likely someone inside the company guiding the customers.

As nearly every employee had access to the customer database we needed to narrow down the leak. After an initial assessment the following action was taken:

• A full data audit was carried out focusing on file movement, emails, printing and viewing
• A TSCM sweep was carried out
• An investigator was placed undercover as an employee of the company to identify the leaks
• Our investigator contacted the ex-customers and asked their reason for changing provider
• A due diligence report on the rival company was performed focusing on people with a vested interest
• Cross-referencing the current employees to the rival company provided a clear suspect
• A full investigation of the suspect was performed including email usage, phone records and known movements
• A full report documenting the suspects' actions (with correct evidence preservation practices) was provided
• Asset and financial loss recovery process were initialised