Scammed from the inside: Internal fraud and how to spot it

When most businesses think about fraud, they picture criminals on the outside—hackers, phishing emails, or stolen cards. But some of the most damaging scams start much closer to home.

Internal fraud and impersonation scams are becoming more sophisticated, often combining human behaviour with technology to exploit trust, urgency and routine processes.

“One of the biggest misconceptions is that fraud always comes from outside the business,” says Westpac Analytics Specialist Uma Parasa. “In reality, fraud often leverages internal access or human behaviour—whether that’s an employee misusing systems or a team member being manipulated by a convincing scam.”

How internal fraud happens

Internal fraud—sometimes referred to as employee theft—occurs when someone with legitimate access to payment systems misuses that access for personal gain.

1. Unauthorised refunds

• Processing refunds to personal or known cards
• Refunding legitimate transactions and taking the cash
• Creating refunds for transactions that never existed

This aligns with known fraud patterns where refund manipulation is used to disguise theft within normal transaction flows.

2. Manipulated or fake transactions

• Cancelling legitimate sales and keeping cash
• Running transactions on stolen or skimmed cards
• Creating false sales followed by refunds

These activities are often harder to detect in busy environments or where oversight is limited.

“Fraud doesn’t always look suspicious at first,” says Uma.

“It often hides in everyday processes like refunds or cancellations, which is why regular monitoring is so important.”

3. The “fake support call” scam

One of the fastest-growing threats to merchants is the impersonation scam, where fraudsters pose as trusted organisations.

Scammers may pretend to be:

• Your bank
• An EFTPOS or IT support provider
• A payments service partner

They typically create urgency:

• A “fault” with your terminal
• A “suspicious transaction”
• A “refund error” that needs fixing immediately.

Then they instruct staff to:

• Process a refund
• Run a “test” transaction
• Send money to a card number they provide.

This mirrors broader impersonation scams affecting NZ businesses, where criminals pose as trusted entities to manipulate payments or access.

“Scammers rely on pressure and urgency,” says Uma Parasa. “If someone is asking you to act quickly—especially involving money—that’s your cue to pause, not proceed.”

Key rule

A legitimate bank or provider will never ask you to:

• Process refunds over the phone
• Send money to a “system” or card
• Complete test transactions during a call.

If you receive one of these requests:

• Stop immediately
• Do not process anything
• Contact your provider using a verified number.

Online & click-and-collect fraud

Fraud is also increasingly happening outside the physical store.

Criminals use stolen card details to purchase:

• Electronics
• Tools
• High-value, easy-to-resell goods.

These transactions are higher risk because they are card-not-present, which is known to be more vulnerable to fraud.

“If a transaction feels unusual—large quantity, no questions asked, urgency to collect—it’s worth taking a second look,” Uma notes.

This reflects wider scam trends where fraudsters exploit convenience channels like online shopping and marketplaces.

Scams are getting smarter

Across all scam types, one thing is consistent: they are becoming more convincing and harder to detect.

• Impersonation scams now mimic real businesses and institutions.
• AI and scripting make scam calls sound more credible.
• Messages create urgency to override careful decision-making.

Simple steps to reduce your risk

Fraud prevention doesn’t require complex systems—just consistent, practical controls:

Strengthen processes:

• Monitor refund and cancellation activity closely
• Make sure refunds match original transactions
• Restrict who can process refunds.

Train your team:

• Educate staff on scam tactics and red flags
• Reinforce “pause and verify” behaviour
• Encourage speaking up if something feels off.

Verify before acting:

• Never act on unexpected payment requests
• Always confirm using trusted contact details
• Be cautious of urgency or pressure.

Keep details up to date:

• Maintain accurate business contact information with your bank
• This makes sure the right person is contacted if suspicious activity occurs.

“Fraud prevention isn’t about mistrust—it’s about awareness,” says Uma.
“When your team knows what to look for and feels confident to question things, you dramatically reduce your risk.”

The reality is simple: The more informed your business is, the harder it becomes for scammers—whether internal or external—to succeed.