The problem with this is that first somebody has to notice. In banking the reports will flow in quickly if somebody lost money. In Roblox, when somebody creat

The problem with this is that first somebody has to notice. In banking the reports will flow in quickly if somebody lost money. In Roblox, when somebody created in-game currency out of thin air or accesses private information of other people, then chances are nobody notices and the audit logs are never manually investigated. Doing automated audits then again brings up the question: how do you determine if something was the result of a genuine support action or fraudulent. You can try to find/train algorithms to detect that, but given that you can only train it against common fraudulent patterns, and do not know about unreported cases by the very definition, you cannot be sure such a system is operating well and/or cannot be easily gamed. Banks have it easier in that regard, because the books have to match end of the day. The law being the deterrent didn't really help here either. According to the article the "hacker" either bribed somebody for access, phished somebody for access or used some vulnerability to gain access. All of which isn't exactly legal, so the deterrent already did not work, tho it might make your own employees think twice about accepting bribes. But the hacker probably will not care about your audit system beyond the point of defeating it long enough to gain whatever they were out to gain.