What to Do in the First 72 Hours After Discovering Fraud
When a scandal hits a credit union, time moves differently. The first 72 hours aren’t just about damage control — they’re about survival. Handled well, you protect members, preserve trust, and contain losses. Handled poorly, you create the perfect storm for regulators, lawsuits, and permanent reputational damage that can follow the institution for a decade.
Fun Fact: In many fraud cases, the cover-up creates more legal trouble than the fraud itself. The institutions that fare best in regulatory scrutiny are the ones that move fast, document everything, and cooperate fully from the first hour.
Hour 0–2: Lock It Down
The moment fraud is confirmed — or even credibly suspected — the priority is containment. Every minute of continued access is another minute of potential evidence destruction or additional theft.
- Freeze Accounts & Access: Immediately revoke all system, account, and physical access for the suspected individual(s). This includes badge access, remote login credentials, and shared system accounts.
- Secure Records: Duplicate all financial records, emails, and communications without altering originals. Chain of custody matters enormously for both prosecution and regulatory review.
- Lock Out Remote Access: Fraudsters often attempt to “clean up” remotely after being caught. Ensure this pathway is closed immediately.
Pro Tip: Have a pre-approved emergency access control procedure so you don’t waste precious time debating authorization in the moment.
Hour 2–8: Assemble the Crisis Team
No one person can manage a fraud crisis alone. The right team needs to be in the room within hours — each with a clearly defined role.
- CEO / Acting CEO — Ultimate decision-making authority for all institutional responses.
- Board Chair — Governance oversight and escalation to the full board.
- CPA / Auditor — Evidence preservation, preliminary scope assessment, and forensic direction.
- Legal Counsel — Regulatory reporting obligations, legal protection, and documentation guidance.
- Communications Lead — Internal and external messaging control to prevent premature or damaging statements.
This team meets within the first few hours and stays in daily contact throughout the response. A disorganized, reactive response is itself a reputational event that regulators and members will notice.
Hour 8–24: Contain the Damage
Once the immediate lockdown is secured and the crisis team is assembled, the focus shifts to understanding the full scope of what happened.
- Identify Scope: How much money is involved? How many members are affected? How long has this been occurring?
- Preserve Evidence: Screenshots, transaction logs, CCTV footage, email archives, and access records must all be secured before they are overwritten.
- Quiet Communication: Notify the board and key regulators privately. Do not issue any public statement yet.
- Suspend Related Processes: If it’s a loan fraud, stop new loan approvals in that department until reviewed.
Hour 24–48: Go on Offense
By this stage, you have enough information to move from purely defensive to strategically proactive.
- Regulatory Reporting: File initial reports to NCUA and law enforcement. Sooner is significantly better for credibility.
- Engage Forensic Accountants: They know how to trace funds and document findings in a format that meets regulatory and legal requirements.
- Set the Narrative: Craft an initial statement emphasizing swift action, transparency, and concrete measures to protect members.
Example statement: “Upon discovery of irregularities, we took immediate steps to protect our members’ funds, launched an independent forensic review, and are cooperating fully with regulators and law enforcement.”
Hour 48–72: Prepare for the Fallout
The first two days were about containment and response. The third day is about managing the aftermath.
Member Communication Plan:
- Clear, simple language that doesn’t minimize or overdramatize.
- Focus on how their money is protected and what steps have been taken.
- Provide a realistic timeline for updates.
Staff Briefing:
- Arm employees with consistent, accurate facts so rumors don’t fill the information gap.
- Staff are often the first point of contact for anxious members — they need to be prepared.
Press Management:
- Limit media contact to a single, trained spokesperson. No exceptions.
Action Plan:
- Corrective measures to prevent recurrence, already in progress.
- Strengthened controls and governance changes with specific timelines.
The CPA’s Role in a Scandal
At JS Morlu, we help credit unions navigate these moments with the financial expertise and regulatory knowledge that crisis management demands:
- Forensically trace stolen or misused funds through transaction analysis and account reconstruction.
- Seal control gaps before fraudsters exploit them again or before examiners find them first.
- Navigate regulatory scrutiny with compliant, well-documented reporting.
- Preserve the confidence of members and stakeholders through transparent, expert-guided communication.
Fun Fact: A well-handled scandal can increase long-term member trust if the credit union demonstrates transparency, decisive action, and meaningful reforms.
The Bottom Line
The first 72 hours define the next 7 years. If you move quickly, communicate clearly, and act with integrity, your credit union can emerge from a scandal bruised but not broken.
📌 Scandal-proof your operations before the crisis hits. Let JS Morlu create your Credit Union Crisis Protocol — a CPA-led plan that ensures your first 72 hours are a display of competence, not chaos.