The former chief financial officer of a Dallas-based charity for children was recently sentenced to five years in prison after he pled guilty to wire fraud.
Federal prosecutors accused former Child and Family Guidance Center CFO Jeffrey Scott Keehn of a scheme that stole about $2.1 million from the nonprofit from 2016 to 2023. Keehn, 55, used the nonprofit’s checking account to write fraudulent checks to himself. He falsely claimed the payments were being made to medical providers and other vendors.
Each payment was less than $10,000 because the nonprofit required payments that exceeded that amount needed to be reviewed by higher-ups. In total, he submitted about 250 checks into three different bank accounts in his name, according to court documents reviewed by The Dallas Morning News.
The nonprofit’s mission is to provide affordable mental health services to children and families.
But…
IT & DATA SECURITY (MITIGATING THE “INSIDER THREAT”)
As seen in the TD Bank case, an employee with too much “access” can sell your customer data to syndicates.
- Principle of Least Privilege (PoLP): Employees should only have access to the specific folders and databases required for their current task.
- Access Revocation: Have a “Termination Checklist” that ensures all digital access (Email, VPN, Banking) is revoked within 60 minutes of an employee resigning or being dismissed.
- System Logs & Audit Trails: Enable “Read/Write Logging” on your server. If a customer’s data is leaked, you need to know exactly which login accessed that record and at what time.
- Encryption at Rest: Ensure that sensitive files (like your customer ID numbers or payroll spreadsheets) are encrypted so that if a staff member copies them to a USB, they cannot be read.