By the end of the three-hour session, participants should be able to:

• Explain what fraud is and distinguish fraud from error, misconduct and other irregularities.
• Understand the basic elements commonly associated with fraudulent conduct.
• Recognise how fraud can affect Postbank, its customers, employees and stakeholders.
• Understand the Fraud Triangle and the circumstances that may increase fraud risk.
• Identify common forms of internal and external fraud relevant to financial institutions.
• Recognise behavioural, transactional and documentary fraud warning signs.
• Understand social engineering and how fraudsters manipulate employees and customers.
• Recognise the relationship between technology, cybercrime and modern fraud.
• Understand how weak controls and control overrides create opportunities for fraud.
• Respond appropriately when fraud or suspicious behaviour is identified.
• Understand the importance of preserving evidence and maintaining confidentiality.
• Appreciate the importance of speaking up and using appropriate reporting and escalation channels.
• Understand that preventing fraud is an organisation-wide responsibility.
  
  

MODULE 1 – FRAUD 101: WHAT DO WE MEAN BY FRAUD?

1.1 Understanding fraud
Introduction to the concept of fraud in practical terms.
Topics include:

• What is fraud?
• Intentional deception and dishonesty.
• Obtaining an unlawful or improper benefits
• Causing another person or organisation to suffer a loss.
• Fraud committed for personal benefit versus fraud committed for the perceived benefit of an organisation.
• Why intent is an important distinction.

1.2 Fraud versus error
Participants consider the difference between:

• Genuine mistakes.
• Negligence.
• Policy violations.
• Misconduct.
• Theft.
• Corruption.
• Fraud.

1.3 Why fraud matters to Postbank
Fraud can result in much more than direct financial loss.
Potential consequences.

Interactive Exercise 1 – Fraud or Not?

MODULE 2 – WHY DO PEOPLE COMMIT FRAUD?

2.1 The Fraud Triangle
Introduction to the three traditional components:

Pressure / Incentive
Opportunity
Rationalisation

2.2 The Fraud Diamond

Introduce capability as an additional consideration.

A person may have pressure, opportunity and rationalisation but still require the knowledge, authority, confidence or system access necessary to execute the fraud.
Practical discussion

MODULE 3 – COMMON FRAUD RISKS IN A BANKING ENVIRONMENT

This section introduces participants to fraud schemes they may encounter directly or indirectly.
3.1 Internal fraud
3.2 External fraud
3.3 Insider-enabled fraud
3.4 Collusion

Practical Case Study – The Helpful Employee

MODULE 4 – SPOT THE RED FLAGS
4.1 Behavioural red flags
4.2 Transactional red flags
4.3 Documentary red flags
Interactive Exercise 2 – Red Flag Challenge

MODULE 5 – SOCIAL ENGINEERING: HACKING THE HUMAN
Fraudsters do not always attack systems. Sometimes they attack the people who have access to those systems.
5.1 What is social engineering?
5.2 Common manipulation techniques
5.3 Phishing and impersonation
5.4 AI, deepfakes and modern impersonation

Mini Scenario – The Urgent Executive Request

MODULE 6 – CONTROLS: HOW WE MAKE FRAUD MORE DIFFICULT
6.1 Preventative controls
6.2 Detective controls
6.3 Why employees matter

MODULE 7 – WHAT SHOULD I DO IF I SUSPECT FRAUD?
7.1 Recognise
7.2 Pause
7.3 Verify
7.4 Preserve
7.5 Report and escalate
7.6 Maintain confidentiality

MODULE 8 – BUILDING A FRAUD-AWARE CULTURE

The final content section reinforces that fraud prevention is not solely the responsibility of the Fraud Department, Internal Audit, Risk or Compliance.

Every employee contributes to the control environment.

A strong fraud-aware culture encourages employees to:

• Follow procedures.
• Ask questions.
• Challenge unusual requests appropriately.
• Protect confidential information.
• Never share credentials.
• Avoid unauthorised system access.
• Declare conflicts of interest.
• Report concerns.
• Cooperate with investigations.

Avoid retaliation against people who raise genuine concerns.

The Three Questions

Before processing something unusual, employees should ask:

1. Does this make sense?
2. Have I independently verified what I need to verify?
3. Would I be comfortable explaining my decision to Fraud, Risk, Internal Audit or an investigator afterwards?

10. FINAL CASE STUDY

Participants work through a consolidated Postbank-style scenario involving a combination of:

• An unusual customer request.
• Urgency.
• A change in information.
• An apparent senior-authority instruction.
• A procedural exception.
• A colleague offering to help bypass a control.
• Unusual system activity.
• Documentary inconsistencies.

Participants must identify:

1. The fraud risks.
2. The red flags.
3. Possible social engineering techniques.
4. Internal control weaknesses.
5. What the employee should verify.
6. What the employee should not do.
7. When the matter should be escalated.
8. What evidence should be preserved.
9. Which internal reporting channel should be used.

The facilitator concludes the case by demonstrating how seemingly insignificant warning signs can become significant when viewed together.

Five Takeaways

Participants should leave the session remembering five core principles:

1. Fraud can happen anywhere.
No organisation, department, process or employee is automatically immune.

2. A red flag is a reason to look closer.
It is not automatically proof that fraud has occurred.

3. Fraudsters exploit people as well as systems.
Urgency, authority, fear and trust are frequently used to manipulate employees.

4. Controls must not be bypassed for convenience.
A control becomes ineffective the moment employees routinely make exceptions.

5. When something does not look right – recognise it, verify it and report it.

• Postbank employees
• Operational staff
• Finance personnel
• Customer-facing employees
• Supervisors and managers