NITAM 2026: How Insider Fraud Is Remaking B2B Payments Risk

September marks National Insider Threat Awareness Month (NITAM for short), and the timing is difficult to ignore. Insider risk is no longer confined to the rogue employee stealing data or diverting funds. In 2026 and going forward, the more urgent threat is trusted access: employees colluding with outsiders, compromised credentials, fraudulent workers gaining legitimate access, and AI making impersonation easier to scale.

For banks and corporates, this fact is changing the questions around insider threat management. The perimeter is no longer outside the organization. The risk today is too often authenticated, employed, approved, and sitting inside normal-seeming workflows. 

Recent Cases Show How Trusted Access Becomes the Attack Path

In May, the U.S. Department of Justice said a former financial-institution employee pleaded guilty to accepting bribes, using their legitimate access to identify high-value customer accounts and sharing confidential information with outside co-conspirators. The scheme facilitated more than $3.4 million in fraud.

That same month, Reuters reported on a 30-defendant insider-trading case in which prosecutors alleged that attorneys exploited authorized access to confidential M&A information and passed it to accomplices. The organizations were victims. The vulnerability was that trusted users could reach information they did not need for their work.

On July 31, the FBI issued a fresh warning about North Korean IT workers using false identities to obtain legitimate employment and access to company systems. The threat may begin outside the organization, but once hired, the actor possesses credentials, devices and permissions that can make malicious behavior look like ordinary work.

The Inside and Outside Threat Models are Converging

Recent Bottomline analysis has noted that many fraud incidents now blur the line between internal and external threats, with trusted access, compromised credentials, and outside manipulation increasingly appearing together in the same attack chain. 

That’s the 2026 insider-risk problem in one sentence. Organizations still need to watch for malicious employees acting for their own gain, but also insiders working with fraud rings, compromised users, contractors with unwarranted access, and fraudulent identities that pass normal onboarding controls.

Static definitions of “inside” and “outside” are becoming less useful. Identity, behavior and context matter more today.

Banks and Corporates are Getting Better at Detection

The broader payments fraud picture shows progress. The Association for Financial Professionals’ 2026 Payments Fraud and Control Survey found that 76% of organizations experienced attempted or actual payments fraud in the past year.

Treasury remains a strong detection point, with 83% of respondents identifying it as the function most likely to discover attempted fraud.

AI is beginning to help. Only 17% of organizations currently use it for fraud mitigation, but adopters reported gains in fraud-reporting efficiency, deepfake detection and real-time identification. But with fraudsters pulling out the stops on AI misuse, organizations taking their time embracing AI defenses are putting themselves at a heightened risk.

The good news is that the AFP findings show solid wins starting to emerge, which means technology use and anti-fraud processes are slowly improving. Better analytics, stronger treasury involvement and faster recognition of anomalies can reduce the time an insider or compromised user has to operate undetected.

Trusted Access is Still Outrunning Fragmented Controls

The loss column is just as clear. AFP found that 74% of organizations were affected by business email compromise (BEC) in 2025, showing how readily criminals can manipulate trusted communications and payment processes.

Insider risk compounds that problem because legitimate activity can conceal malicious intent. An employee may be authorized to view an account, approve a payment or access a system. A contractor may have valid credentials. A fraudulent remote worker may have passed onboarding. Viewed one transaction or login at a time, nothing looks “wrong.”

The signal often emerges only when organizations connect behavior across identity, access, application and payment data. Fragmented monitoring creates blind spots.

The Next Advantage Will Come from Continuous Verification

There is growing consensus that continuous verification is the “so what” for National Insider Threat Awareness Month 2026.

Banks and corporates should be moving toward continuous verification of trusted activity, not simply periodic reviews of who has access. That means monitoring behavioral deviations across systems, enforcing least-privilege access, separating critical duties, independently verifying unusual payment and account changes, and bringing fraud, cyber, treasury, compliance and security teams into the same response model.

The FBI’s latest warnings also point toward a harder look at identity throughout the employee lifecycle, especially for remote and privileged roles. Hiring controls alone are not enough if identity, device location and behavior are never revalidated after access is granted.

Organizations gaining ground do not eliminate trust. They make trust observable.

The advantage will belong to institutions that can spot when legitimate access stops behaving legitimately and act before an anomaly becomes a loss.