A small customer focused bank with implemented least privilege principles, is concerned about the possibility of branch staff unintentionally aiding fraud in their day to day interactions with…

An information disclosure policy establishes rules about what can be shared, but without training, staff may not recognize when a customer interaction crosses policy boundaries through social manipulation.

Awareness training directly addresses the behavioral risk by educating branch staff on social engineering tactics, appropriate information boundaries, and how personal relationships can be exploited by fraudsters. Because the threat is unintentional and relationship-driven rather than malicious insider activity, changing staff behavior through education is more effective than structural or technical controls.

Job rotation mitigates risks from knowledge concentration and insider collusion but does not address the social dynamics of personal customer relationships being exploited for fraud.

Separation of duties divides tasks among multiple individuals to prevent single-person fraud but does not address the risk of unintentional disclosure or assistance caused by staff-customer friendships.