Worked at a bank. Usually stayed late/came early/irregular hours. Therefore had access code to the key safe, for confirming everyone put their keys in the key

Worked at a bank. Usually stayed late/came early/irregular hours. Therefore had access code to the key safe, for confirming everyone put their keys in the key safe. But this was for front office and back office. Access to all keys. Small team, 10 people. That's important. Knew how much we had in the petty cash bank account. Usually around USD 40MM. Liquidity usage, etc. Also had access to the cheque book (via key locked cabinet), where via sealed internal mail, cash payment requests (cheque) were sent to the banking department. Speaking to a friend in the banking department, he remarked that whitelists of authorised payment receivers where being introduced. Being introduced? "Sure, if a payment request comes in, and it is authorised correctly (signature, in case of cheques), we send it ASAP." "Do you telephone the signer to verify? No." "Any transaction limits?" "No." This was 2005. Could have walked away with USD 40MM - then fled rapidly to another country. But didn't. Well, did go to another country. 2 factor authentication is essential, and whitelists too - a central bank doesn't change their account number. The FED seems to have had neither.