These are patterns of behaviour, not personality types or diagnoses of people. Scenarios are hypothetical learning examples, not real incidents. Research and source-review limits are preserved from the dated Hebrew original.
What happens
Someone with legitimate access, at a checkout, call centre or branch, copies or sells internal information.
Warning sign
An unexpected contact who knows information that should be private.
Safer action
Share only the information a form needs. If someone knows private details about you, ask where they obtained them and report the contact to the organisation holding that information.
Hypothetical illustration: copied during work, not stolen in a break-in
A checkout, call-centre or branch employee sees hundreds of people's details daily: IDs, cards, accounts. One day they copy a small list. No lock was broken; the key was already in their pocket. Then someone outside offers to pay for a "small favour," just once. Then again.
This pattern begins with legitimate access meeting opportunity or pressure, rather than with an initial deception.
How the pattern works
The Insider is malicious misuse of access in two forms: an employee acting alone, or outside recruitment by someone buying the employee's access. For the victim, the outcome is similar: information reaches strangers from a place they trusted.
A boundary matters: a negligent leak, such as exposed documents, a shared password or human error, is different. It creates exposure and calls for tighter procedures, but does not prove malicious action. This section focuses on consumer fraud. The Insider is a brief account of how information gets out, not a review of occupational fraud.
From an investigator's perspective
An offender possessing information does not necessarily prove an insider helped. Distinguish deliberate misuse of permissions, negligence and a leak from an outside source. The question is what the evidence establishes, not only what looks suspicious.
Possible explanations for the behaviour
This is a possible interpretation, not a diagnosis of a person. Where there is no evidence of thought or intent, these remain hypotheses.
Pressure, opportunity and rationalisation are known as the fraud triangle. A critical review notes that Cressey did not use that term himself and warns against using it as a general prediction tool [12]. The fraud diamond adds capability [7]. "I am only copying, not stealing" is a hypothetical justification, not a research quotation or evidence about an employee. Access itself can be checked and restricted.
What research shows
- Workplace vulnerability: in 34.1% of the 517 Utica identity-theft cases, 176 cases, the vulnerability point was the offender's own workplace [3].
- Where: of theft-through-employment cases, 43.8% were in retail and services, such as shops, petrol stations and restaurants [3].
- In the UK: in eight of the Police Foundation's 25 investigations, a legitimate role provided the fraud opportunity [2].
What the research cannot tell us
34.1% does not mean one third of employees are prone to crime. The denominator is detected criminal cases, not employees. Nor does it mean most leaks are malicious; some are passive. These are US and UK figures, with limited generalisability to Israel.
What to do
- As an individual: ask who sees your details and why. Supply only what is necessary on each form.
- As an organisation: access limited to what each role needs, separation of duties and monitoring for unusual use, rather than personality tests.
- If an approach shows inside knowledge of your details, ask where it came from and report it to the original organisation.