Theories of Criminal and Fraudulent Behaviour

Introduction

Fraud and other financial crimes are not explained adequately by assuming that offenders are simply “bad people.” They arise from interactions among motivation, opportunity, capability, social context, organizational controls, victims’ behaviour and ethical judgement. A bank employee may misuse access because of personal financial pressure, weak supervision, technical expertise and a belief that the institution can absorb the loss. A customer may disclose credentials because a message appears legitimate. A bystander may notice warning signs but remain silent because responsibility seems to belong to someone else.

This chapter introduces theories that help investigators, compliance officers, risk managers and policymakers explain these events systematically. The theories are complementary rather than mutually exclusive. Some emphasize the offender’s decision; others explain environmental opportunity, organizational weakness, social influence or moral disengagement.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the Fraud Triangle, Fraud Diamond and MICE frameworks.
2. Apply routine activity theory to offenders, victims, targets and guardianship.
3. Use rational-choice and deterrence perspectives without assuming perfect rationality.
4. Explain opportunity theory and behavioural ethics in financial-crime settings.
5. Diagnose organizational vulnerabilities and propose proportionate controls.
6. Integrate theories in a structured analysis of a fraud case.

1. Fraud as an interaction of person, situation and system

A useful analytical distinction is between causal explanation and moral justification. A theory may explain why an offence became more likely; it does not excuse the offender. Similarly, identifying victim vulnerability does not transfer blame from the offender to the victim. In professional practice, theories should be used to improve prevention, detection and fair treatment—not to stereotype employees, customers or communities.

Fraud generally involves intentional deception or concealment for gain or to cause loss. Financial crime includes fraud, money laundering, corruption, market abuse, terrorist financing and related offences. The theories in this chapter are especially useful because financial institutions contain valuable assets, extensive digital access, complex processes and information asymmetries.

2. The Fraud Triangle

Donald Cressey’s Fraud Triangle identifies three commonly interacting conditions:

• Pressure or incentive: a perceived financial, occupational, social or emotional need.
• Opportunity: a perceived ability to commit and conceal the act.
• Rationalization: a story that makes the conduct appear acceptable to the offender.

The model is not a mechanical equation. The three elements need not be equal, and their presence does not prove that fraud will occur. It is a diagnostic framework for asking what conditions made misconduct thinkable and feasible.

Pressure

Pressure may include debt, gambling, addiction, status expectations, job insecurity, performance targets or resentment. A pressure can be real, exaggerated or entirely self-imposed. Importantly, most people under pressure do not commit fraud. Pressure becomes more significant when combined with opportunity and ethical disengagement.

Opportunity

Opportunity is shaped by access rights, segregation of duties, authentication, approval design, monitoring, data quality and the likelihood of detection. Remote work, automated processes and third-party integrations can create opportunities that were absent in traditional branch operations.

Rationalization

Common rationalizations include “I am only borrowing it,” “the company owes me,” “everyone does it,” and “no customer will notice.” Rationalization reduces psychological discomfort by redefining the act as temporary, deserved, harmless or normal.

3. The Fraud Diamond

The Fraud Diamond extends the Triangle by adding capability. Capability includes technical skill, authority, confidence, persuasive ability, knowledge of controls and the ability to withstand stress. A person may have pressure and opportunity but lack the capability to manipulate a core-banking system or recruit a colluder.

Capability is particularly important in cyber-enabled fraud. A privileged administrator, application developer or knowledgeable fraudster may understand system exceptions, logging gaps and approval routines. Prevention therefore requires least privilege, privileged-access management, rotation of sensitive duties, independent review and monitoring of anomalous behaviour.

The Fraud Diamond should not be interpreted as claiming that capability is always a separate cause. In some cases it is an enabling condition within opportunity; in others it explains why one individual exploits an opportunity while colleagues do not.

4. MICE: motivation in insider fraud

The MICE model classifies motives as:

• Money: desire for financial gain or relief from financial difficulty.
• Ideology: political, social or personal beliefs used to justify the act.
• Coercion: threats, blackmail or pressure from another person.
• Ego or entitlement: desire for recognition, revenge, status or proof of superiority.

MICE is useful for insider-risk assessment because the same control may not address every motive. Financial monitoring may identify unexplained wealth, but it will not necessarily detect ideological sabotage or coercion. A sound programme combines access controls, welfare and speak-up channels, conflict-of-interest declarations, behavioural monitoring subject to law, and support for employees experiencing threats.

5. Routine activity theory

Routine activity theory explains crime through the convergence in time and space of three elements:

1. A motivated offender.
2. A suitable target.
3. The absence or weakness of a capable guardian.

The theory does not require that the offender be permanently criminally motivated. Routine activities—online banking, payment processing, customer-service calls and employee access—create recurring encounters among these elements.

Figure: Routine activity theory. All three conditions contribute to the convergence that produces an offence opportunity.

A target may be a customer account, payment instruction, identity record, cash reserve or cloud credential. Guardians include employees, authentication controls, transaction limits, reconciliations, alert systems, regulators and informed customers. Guardianship is not limited to physical observation; it includes any person or control capable of preventing, interrupting or detecting the act.

For victims, the theory directs attention to exposure without implying blame. A customer using a mobile device on an unsafe network may be a more suitable target, but responsibility remains with the offender and with institutions that can reasonably improve authentication and warnings. For bystanders, the theory asks whether reporting channels, supervisory attention and role clarity make guardianship realistic.

6. Rational choice and bounded decision-making

Rational-choice theory proposes that offenders compare expected gains and expected costs, but financial criminals often have incomplete information, biased judgement and limited time. A correct expected-utility representation must distinguish the probability of obtaining the benefit from the probability of detection and sanction.

Here, p_B is the probability that the intended benefit is successfully obtained; U_B is the utility or monetary value of that benefit; p_D is the probability of detection and effective sanction; U_D is the utility or monetary loss associated with that sanction; and C is the cost of planning, execution, stress and other resources. All terms must be expressed in a common utility unit, such as monetary-equivalent units. The simplified expression assumes additive expected values, mutually interpretable probabilities and that the relevant benefit and sanction outcomes can be represented by these terms.

If p_B = 0.8, U_B = 10,000, p_D = 0.25, U_D = 12,000 and C = 1,000 monetary-equivalent units, then:

The positive result does not predict that the person will offend. Risk aversion, shame, loyalty, morality, uncertainty and non-monetary consequences may alter the decision. The model is most useful for comparative questions: stronger detection may raise p_D, faster recovery may reduce U_B, and access restrictions may increase C or reduce p_B.

7. Deterrence theory

Deterrence is commonly analysed through the perceived certainty, swiftness and severity of punishment. In financial institutions, certainty often matters more than extreme severity. A consistently applied review, credible investigation and timely consequence may deter more effectively than a severe penalty that appears unlikely.

Deterrence has two forms:

• General deterrence: discouraging the wider population through visible enforcement.
• Specific deterrence: discouraging a person who has already been sanctioned from repeating the conduct.

Deterrence has limits. Offenders may discount future consequences, believe they are exceptional, misunderstand controls or act under coercion. Excessive surveillance can also damage trust, privacy and employee morale. Proportionate, lawful and explainable controls are therefore essential.

8. Opportunity theory and organizational design

Opportunity theory focuses on how environments make crime easier, more rewarding or less risky. It directs attention from “Who is dishonest?” to “What features of the process permit and conceal misconduct?” Relevant features include:

• excessive privileges and shared credentials;
• single-person initiation and approval;
• weak reconciliation and exception handling;
• predictable control routines;
• poor vendor oversight;
• unreviewed dormant accounts;
• fragmented data and delayed alerts;
• pressure to bypass controls for customer-service speed.

Situational crime-prevention measures seek to increase effort and risk, reduce rewards, reduce provocations and remove excuses. Examples include transaction limits, dual approval, confirmation through an independent channel, tamper-evident logs, rapid account freezing and clear policies. Controls should be tested against adaptation: when one route closes, offenders may migrate to social engineering, collusion or a third-party channel.

9. Behavioural ethics

Behavioural ethics studies how ordinary people make ethical errors despite knowing general rules. It is especially valuable because fraud is not always committed by individuals who see themselves as criminals.

Offenders and moral disengagement

Ethical fading occurs when a decision is framed as a sales, technical or performance issue rather than a moral one. Bounded ethicality arises when attention, incentives or social pressure narrow judgement. Moral disengagement may involve euphemistic language, diffusion of responsibility, advantageous comparison or blaming the victim.

Small initial violations can produce escalation. An employee first changes a date, then overrides a limit, then conceals an unauthorized transfer. Normalization of deviance occurs when repeated exceptions become treated as normal.

Victims

Behavioural ethics must also examine victim decision-making without victim blaming. Customers may comply with an urgent request because authority cues, fear and cognitive overload reduce reflection. Scarcity, time pressure and trust exploitation can impair the ability to verify a message. Institutions have an ethical duty to design warnings that are understandable, timely and tested with vulnerable users. A victim’s mistake does not make deception ethically neutral.

Customers may also face an ethical conflict when a suspicious transaction benefits them—for example, receiving an unexpected refund or being asked to lend an account. Education should explain duties to report and verify without assuming that all customers possess equal digital literacy.

Bystanders and witnesses

Bystander inaction can result from diffusion of responsibility, fear of retaliation, loyalty to colleagues, uncertainty about evidence or belief that reporting will be futile. A “speak-up” culture requires confidential channels, protection from retaliation, feedback on reports and clear escalation criteria. Training should include not only the duty to report but also safe methods of preserving evidence and avoiding confrontation.

Organizations and ethical climate

Organizations influence conduct through targets, leadership messages, rewards and the treatment of exceptions. A bank that publicly emphasizes integrity but rewards only sales volume creates ethical fading. Conversely, managers who discuss dilemmas, reward escalation of concerns and investigate senior personnel consistently strengthen ethical infrastructure. Behavioural ethics therefore connects individual judgement with governance design.

10. Integrating the theories

The theories answer different questions:

No single theory should be used as a complete risk score. For example, a high-pressure employee with no system access may present less immediate fraud risk than a moderately pressured administrator with broad privileges and weak oversight.

11. Illustrative case: the duplicate-payment scheme

Background. A fictional regional bank used an accounts-payable platform in which one employee could create a vendor, amend bank details and approve payments below a threshold. Reconciliation occurred monthly.

Problem. Over six months, a payments officer created a fictitious vendor resembling a genuine supplier. The officer submitted several low-value invoices and directed funds to a personal account. The total loss was modest initially, so alerts were not triggered.

Analysis. The Fraud Triangle identifies personal debt as pressure, a weak approval structure as opportunity and the belief that the bank could absorb small losses as rationalization. The Fraud Diamond adds capability: the officer understood vendor coding and payment timing. Routine activity theory shows a motivated offender, a suitable payment process and weak guardianship. Opportunity theory identifies predictable thresholds and delayed reconciliation. Rational choice suggests that low perceived detection reduced p_D, while the repeated small payments reduced perceived consequences. Behavioural ethics helps explain why colleagues who noticed unusual vendor descriptions did not report them: ambiguity and diffusion of responsibility weakened bystander guardianship.

Approach. The bank introduced independent vendor verification, separated vendor creation from payment approval, performed daily exception analytics and required review of repeated payments just below the threshold. It also established a confidential reporting channel and trained managers to discuss near misses without retaliation.

Outcome. In this illustrative scenario, the redesigned controls would reduce opportunity, increase detection probability and strengthen guardianship. They would not eliminate fraud; collusion, credential theft and vendor compromise remain possible.

Learning points. Small transactions can be strategically structured. Control effectiveness depends on independence, timeliness and coverage, not merely on the existence of a policy. Cultural interventions are necessary because technical controls cannot guarantee that suspicious conduct will be escalated.

12. Professional application and limitations

Investigators should use theories as hypotheses and test them against evidence: access logs, communications, transaction patterns, approvals, device data, interviews and control histories. A theory must not substitute for proof of conduct or intent. Risk teams should distinguish leading indicators from evidence of wrongdoing; financial stress, unusual working hours or assertiveness are not proof of fraud.

There are also methodological limitations. The Fraud Triangle can be too broad and may appear to explain every event after it occurs. Rational-choice models can overstate calculation. Routine activity theory may underplay structural inequality and institutional responsibility. Behavioural ethics findings may vary across cultures and contexts. MICE categories can overlap. Effective practice therefore triangulates theories, uses lawful data, protects due process and tests whether controls create unintended exclusion or privacy harms.

Artificial intelligence can support anomaly detection, entity resolution and prioritization, but it does not determine motive. Models may reproduce biased historical decisions, generate false positives or encourage automation complacency. Human review, explainability, access governance, model validation and appeal mechanisms remain necessary.

Chapter Summary

Fraudulent behaviour is best understood as a product of interacting individual, situational and organizational conditions. The Fraud Triangle emphasizes pressure, opportunity and rationalization; the Fraud Diamond adds capability; and MICE distinguishes money, ideology, coercion and ego or entitlement. Routine activity theory explains how a motivated offender, suitable target and weak guardian converge. Rational choice models perceived benefits and costs, but must distinguish the probability of successful gain from the probability of detection and sanction and must express all values in a common utility unit. Deterrence emphasizes credible certainty, swiftness and proportionality. Opportunity theory directs attention to process design and control weaknesses. Behavioural ethics explains ethical fading, moral disengagement, victim vulnerability, bystander inaction and organizational culture. Used together, these frameworks support fair investigation, stronger controls and more resilient financial institutions.

Key Terms

Fraud Triangle: Model involving pressure, opportunity and rationalization.

Fraud Diamond: Fraud Triangle extended by capability.

Pressure: Perceived need or incentive that may motivate misconduct.

Opportunity: Conditions that make an offence feasible or concealable.

Rationalization: Justification that makes misconduct acceptable to the actor.

Capability: Skills, authority and confidence needed to exploit an opportunity.

MICE: Motive categories of money, ideology, coercion and ego or entitlement.

Routine activity theory: Theory explaining crime through convergence of offender, target and weak guardianship.

Motivated offender: Person willing or prepared to commit an offence.

Suitable target: Person, asset, account or process attractive or accessible to an offender.

Capable guardian: Person or control able to prevent, interrupt or detect misconduct.

Rational choice: Perspective that perceived benefits and costs influence decisions.

Deterrence: Prevention through credible expected sanctions.

General deterrence: Discouraging potential offenders broadly.

Specific deterrence: Discouraging a previously sanctioned offender.

Opportunity theory: Explanation focusing on environmental features that enable crime.

Behavioural ethics: Study of ethical decisions and failures in real contexts.

Ethical fading: Loss of moral salience when an issue is framed in non-ethical terms.

Diffusion of responsibility: Reduced personal action because responsibility appears shared.

Normalization of deviance: Acceptance of repeated exceptions as ordinary practice.

Review Questions

Short Answer Questions

1. What are the three elements of the Fraud Triangle?
2. How does the Fraud Diamond extend the Fraud Triangle?
3. Identify the three elements of routine activity theory.
4. Distinguish general deterrence from specific deterrence.
5. What is ethical fading?

Long Answer Questions

1. Compare the Fraud Triangle, Fraud Diamond and MICE frameworks.
2. Explain how opportunity theory can guide redesign of a payment process.
3. Discuss the assumptions and limitations of rational-choice analysis in financial crime.
4. Explain how behavioural ethics applies to offenders, victims, bystanders and organizations.
5. Evaluate the role of guardianship in preventing cyber-enabled fraud.

Analytical / Application Questions

1. A bank employee under severe debt has privileged access, notices weak monitoring and believes the institution treats employees unfairly. Apply at least four theories to assess the risk and recommend controls.
2. A customer receives a convincing urgent message requesting a one-time password, while a call-centre employee notices unusual account changes but does not escalate them. Analyse the offender, victim, bystander and organizational factors.
3. Design a fraud-risk investigation plan for repeated payments just below an approval threshold. Identify hypotheses, evidence, ethical safeguards and preventive redesign measures.

Multiple Choice Questions with Answers

Question 1

Which element was added by the Fraud Diamond to the Fraud Triangle?

A. Capability

B. Guardianship

C. Deterrence

D. Ideology

Correct Answer: A. Capability

Question 2

Which set correctly states routine activity theory’s core convergence?

A. Pressure, rationalization and capability

B. Motivated offender, suitable target and weak or absent capable guardian

C. Money, ideology and coercion

D. Certainty, swiftness and severity

Correct Answer: B. Motivated offender, suitable target and weak or absent capable guardian

Question 3

In the rational-choice expression EU = p_B U_B − p_D U_D − C, what does p_D represent?

A. Probability of obtaining the benefit

B. Probability of detection and effective sanction

C. Value of the benefit

D. Cost of planning

Correct Answer: B. Probability of detection and effective sanction

Question 4

Using p_B = 0.8, U_B = 10,000, p_D = 0.25, U_D = 12,000 and C = 1,000, what is EU?

A. 2,000 monetary units

B. 3,000 monetary units

C. 4,000 monetary units

D. 5,000 monetary units

Correct Answer: C. 4,000 monetary units

Question 5

Which MICE motive most directly refers to blackmail or threats?

A. Money

B. Ideology

C. Coercion

D. Ego

Correct Answer: C. Coercion

Question 6

A colleague remains silent because several others witnessed the same warning sign. Which behavioural-ethics concept best explains this?

A. Diffusion of responsibility

B. Capability

C. Specific deterrence

D. Target suitability

Correct Answer: A. Diffusion of responsibility

Question 7

Which control most directly reduces the opportunity created when one employee can create a vendor and approve its payment?

A. Independent segregation of vendor creation and payment approval

B. Increasing sales targets

C. Publishing a general ethics slogan

D. Reducing customer communications

Correct Answer: A. Independent segregation of vendor creation and payment approval

Question 8

Which statement about victims is most consistent with the chapter?

A. Victims are responsible whenever they fail to verify a message

B. Victim vulnerability can be analysed without transferring responsibility for deception

C. Victims are never relevant to routine activity theory

D. Victim behaviour proves offender intent

Correct Answer: B. Victim vulnerability can be analysed without transferring responsibility for deception

Question 9

General deterrence primarily aims to:

A. Discourage the wider population through credible enforcement

B. Reward a previously sanctioned offender

C. Increase the value of criminal gains

D. Remove all organizational guardians

Correct Answer: A. Discourage the wider population through credible enforcement

Question 10

Which statement best describes ethical fading?

A. A control becoming technically stronger over time

B. A moral issue losing salience when framed as a routine business or technical issue

C. A customer becoming a more suitable target

D. The probability of detection increasing automatically

Correct Answer: B. A moral issue losing salience when framed as a routine business or technical issue