OK thanks for sharing your thoughts! Much appreciated. For now I reported to my direct manager and the HR manager, asking what HR's follow up actions are going to be (suggesting process review / staff refresher on processes, and reporting to fraud department). I expect they may want to keep this small, but let's see.