Fraud detection: the behavioural signs that expose insider threats

Fraud detection begins before the act, with perpetrators exhibiting early behavioural and linguistic signals that can reveal deceptive behaviour

Fraud is on the rise in Australia, with insider threats posing a growing risk to businesses. A recent report led by Docusign and Entrst says 61% of organisations are experiencing more frequent incidents of fraud, while the 2023 LexisNexis True Cost of Fraud Study – Asia Pacific report shows 66% of Australian businesses have reported a rise in fraud over the past year. For every dollar lost, businesses incur an average total cost of $3.68, factoring in recovery, legal, and operational expenses. 

With fraud on the rise, the ability for organisations to detect insider threats early is more critical than ever. 

Every fraudster carries an involuntary informant: their own body, according to Julian Claxton, Managing Director of Jayde Consulting. Speaking at the Protective Security Summit NSW held at UNSW Sydney, co-hosted with the Australian Security Research Centre and Risk 2 Solution, Mr Claxton urged security managers to pay closer attention to human behaviour, specifically the involuntary signs that may signal deception before any wrongdoing occurs. 

“Fundamentally, the body gives you away regardless of what you’re thinking. Every mistake you make, every lie you tell, follows a predictable pattern,” Mr Claxton explained. “The brain will give you away before the act itself, and it might justify the behaviour in the way you're thinking. And you might think ‘I can suppress this, I can control this,’ but your body and the actions through your body will always give you away.”

In a session titled “The Involuntary Informant: Human Behaviour as a Window into Insider Threats,” Mr Claxton outlined key behavioural insights to help security managers and their organisations better spot incidents of fraud before major damage is done. 

Understanding how the brain gives us away 

So how does the body give insider informants away? Mr Claxton explained that deception triggers an automatic response in the brain, often long before a person acts or commits the fraud. Specifically, he likened parts of the brain to an executive team responding to a threat. 

First, the amygdala, acting as the brain’s chief security officer, senses danger and triggers emotional responses like fear. Next, the hypothalamus, or the chief operating officer, prepares the body by releasing adrenaline and cortisol. Meanwhile, the hippocampus, chief data officer, scans past memories to assess risk based on previous experiences. Finally, the prefrontal cortex, the brain’s chief executive officer, weighs up the consequences and decides what to do next. “You're consciously thinking about, should I or shouldn’t I? But your brain has already started processing the response, it's already started the physiological and chemical process to determine how you will handle the next steps,” Mr Claxton said. 

Learn more: Inside the mind of employee fraudsters: why they cross the line

In high-stakes moments – including insider fraud – this internal “battlefield” floods the body with stress signals, many of which leak out involuntarily. “It’s the battlefield between all of these emotions,” he continued. “And when deception is involved, the amygdala often drives the initial response before the conscious brain can intervene. Cortisol, that stress hormone, spikes under the pressures of deception. It’s trying to maintain awareness, kick you in tip-top shape so you can hide the deception.” 

Watch out for these physical and verbal red flags 

One of the most telling physical or visual signs of an insider threat may come from a person’s micro-expressions – tiny, involuntary facial reactions that often reveal our true emotions. Security managers and leaders should therefore learn to spot these little windows of fear, disgust, sadness, or anger, as they often surface when someone is contemplating or covering up wrongdoing. 

“Micro-expressions are the leaking of emotion, one of those seven emotions we mentioned earlier, through the face. It's a muscle contraction that takes, in most instances, about 1/25 of a second. And it's very, very revealing. You cannot control it,” Mr Claxton explained. “There is a tremendous amount of research on micro-expressions, particularly based on the extensive work of Dr Paul Ekman and others. If you learn how to identify them, that can be quite valuable."

In addition to body language, Mr Claxton said that linguistic cues are a goldmine for detecting deception in the workplace. Some of the most common verbal signs to watch out for include: 

• Hesitating longer than 1.5 seconds before answering.  
• Providing unnecessary or irrelevant information. 
• Becoming overly defensive, even when not directly accused. 
• Trying too hard to seem trustworthy (also known as “impression management”). 

Photo gallery: The Protective Security Summit NSW 2025, hosted at UNSW Sydney

Mr Claxton gave an example of impression management: “You might say to the boss, hang on a sec, what are you inferring? I've been with this company for 22 years. I've been a loyal employee. I've done nothing wrong. I'm nothing but a good person. I'm a member of the scouts. I contribute. I give money to charity etc,” he said.  

These shifts in speaking and tone of voice could potentially reveal internal cognitive stress, which is the brain scrambling to maintain deception under pressure. 

Focus on baseline behaviour and notice shifts 

One of Mr Claxton’s most important takeaways is not to judge these behaviours in isolation. Instead, try to focus on understanding each person's baseline behaviour – how they usually speak, act, and react – and then look for significant shifts in their behaviour. “Just because somebody stutters or hesitates doesn’t mean they’re guilty. They might actually stutter or hesitate as standard general behaviour,” he said. 

Instead, detection depends on observing clusters of unusual actions, and shifts in tone, body language, or communication style compared to their normal self. “Understand what a person's baseline looks like... and look for a shift from that baseline,” Mr Claxton said. “You might start to see subtle shifts in people's behaviour, they might start squirming a little bit. They might suddenly be particularly rigid when following rules when previously they weren't.” 

This helps avoid false positives while still identifying genuine warning signs of insider risk. 

Build a culture of early detection 

Finally, it’s important to recognise that insider threat behaviour often emerges early, sometimes even before a crime is committed. This early detection is especially valuable for security managers to identify and address potential risks proactively. 

Subscribe to BusinessThink for the latest research, analysis and insights from UNSW Business School

Mr Claxton referenced espionage studies that track insider behaviour across several stages: planning, opportunity seeking, action, concealment, and escape. “It talks about indicators at every stage, from the concept, thinking about what you're going to do, planning what you're going to do, then seeing and identifying the opportunity, doing it, concealing it, and then the consumption of the escape. At every stage, you're going to see some of these indicators.”

In other words, fraudulent intent is often detectable long before it turns into a serious breach. “The moment a person starts seriously thinking about stealing a file or committing fraud, their body is already betraying them," Mr Claxton reiterated. “Deception will set up a neurochemical response, and it slips past conscious control. There is nothing you can do to control those physiological outputs at the time that they occur,” he said. “What the mind conceals, the body reveals.” 

He urged organisations to train staff in reading behavioural clues and building a culture of early detection. “Learn it yourself. Teach amongst your employment, your employee base, how to recognise those indicators so that you can stop the threat before the threat stops you," Mr Claxton said. 

Recognising these early signs can empower organisations to intervene early, protecting assets, reputation, and safety. “You don’t have to be an expert to know something isn’t right – trust your gut instinct as a clue to look a bit closer than jump to conclusions.”