Let me tell you all something you may not know.
GL stands for General Ledger, in banking, it’s the master set of accounts a bank uses to record every financial transaction: deposits, withdrawals, fees, interest, internal transfers, suspense entries, all of it.
Each GL account tracks a specific category of activity. Some are customer-facing (like a savings product’s interest accrual account); others are purely internal, used to temporarily hold funds during processing (suspense accounts), or to track a product/campaign that’s since been discontinued.
The reason GLs matter for fraud risk: they’re internal bank accounts, not customer accounts, so movements on them are supposed to be reconciled and explained by staff, not customers.
If a GL is actively monitored, any unexplained entry gets caught quickly. If it’s neglected (a “dormant” or “abandoned” GL nobody checks anymore), unauthorized postings can sit there unnoticed for a long time.
Dormant GLs are one of the quietest fraud risks in banking ops.
If a general ledger account isn’t actively reconciled every cycle, by design or by neglect, it becomes a blind spot.
Settlement and reconciliation teams have legitimate access to post and clear entries; that same access, left unmonitored, is exactly what a bad actor needs to move money quietly.
Here’s how the gap usually forms:
A GL gets created for a specific product or campaign, activity winds down, but the account itself is never formally closed. Over time, whoever’s doing recon stops checking it because “nothing happens there anymore.”
That assumption is the vulnerability. An account with no expected activity is actually easier to abuse than a busy one, because any movement on it should be an instant red flag, except nobody’s watching for it.
4 controls that close this gap fast:
1.Mandatory attestation on every GL every cycle, no exceptions for accounts labeled “inactive”
2.Hard segregation between who can post to a GL and who reconciles it
3.Automated exception reports on any GL with zero expected movement for 90+ days
4.A formal GL retirement process; if a product or purpose is dead, the account should be closed, not left open and unwatched
If your bank’s GL inventory has accounts nobody’s genuinely reviewed in the last year, that’s not just administrative debt sitting quietly on a spreadsheet. That’s exposure, and exposure doesn’t announce itself until it’s already been exploited.
At the beginning of this year, I wanted to find out how much water I’d drink over six months and eventually, a full year.
So I made a conscious effort to keep every single bottle of water I finished, even the ones I drank while I was out. I’d put the empty bottles in my car and bring them home.
Six months later, I’ve gone through 55 pack and 660 bottles of 75cl Aquafina, that’s a total of 495 liters of water.
Not bad at all.🙂↔️💧