Vault Heist Red Flags: A Security Manager's Pre-Breach Checklist

Most vault attacks are not surprises. They are conclusions. By the time someone is burning through a door with a torch or walking a manager through a drill at gunpoint, a long chain of small, observable decisions has already been made—by the attacker, and often by the institution too. The value of a pre-breach checklist is that it moves your attention upstream, to the weeks and days when a warning sign is still just a nuisance instead of evidence.

No checklist prevents every attempt. What it does is shorten the gap between "something feels off" and "we have a documented reason to act." Treat the items below as triggers, not trivia. Each one should have a name attached to it, a place to log it, and a person authorized to escalate it without waiting for a meeting.

People Watching the Building More Than the Business

Vault work requires reconnaissance, and reconnaissance looks mundane. Someone counts the armored car. Someone times the shift change from a parked car with the engine running. Someone asks a teller how late the branch is open on Fridays, twice, on different days. Individually these are nothing. Clustered, they are a pattern.

Train staff to notice repetition rather than to profile anyone. A customer who returns three days in a row at the same hour without a transaction is a more useful observation than a vague description of how someone looked.

• Same vehicle or same person appearing at opening, closing, or during cash deliveries on multiple days.
• Photography or video of cameras, doors, roof access, or the vault room corridor—including phone cameras held casually at chest height.
• Questions about alarm response times, whether police are on site, or who holds the second key.
• Delivery drivers, contractors, or inspectors showing up without a scheduled visit or without the correct paperwork.
• Attempts to keep a specific employee talking—especially one who opens, closes, or has vault access.

What to do with it

Keep a simple incident log at the front desk and at the security console, and require entries the same day. A pattern you can point to is what gets law enforcement and corporate security to move. A pattern that lives in three people's memories does not.

Staff Behavior and Pressure Signals

Insider involvement is a recurring feature of serious vault losses, and it rarely announces itself. The useful signals are changes in behavior, not personality. A long-tenured employee who suddenly avoids being alone with the vault, or who volunteers to work openings they used to trade away, deserves a conversation—not an accusation.

Watch for financial or personal pressure that arrives faster than the person can absorb it. Gambling losses, a divorce, a medical bill, a business venture that needs cash. Again: pressure is not guilt. It is a reason to be more careful about access and to make sure dual controls are actually being honored.

• Unexplained reluctance to take scheduled vacation or to rotate off vault duty.
• Refusal to follow dual-control procedures, framed as "it's faster this way."
• Sudden interest in alarm zones, camera blind spots, or the exact limits of the time-delay function.
• Keys, badges, or access codes temporarily "borrowed" or left unattended.
• Discrepancies in deposit records that are explained away rather than corrected.

The procedural test that matters

Run dual control as an actual test, not a policy. Assign two people who did not choose each other, and see whether the procedure holds when it is inconvenient. If it collapses under mild pressure, it will collapse entirely under real pressure.

Physical Conditions That Quietly Invite an Attack

Attackers pick the easiest target in a corridor, not the hardest. Physical drift is gradual: a camera gets blocked by a new sign, a light burns out over a side door, a dumpster gets parked beneath a second-floor window. None of these is a breach. All of them are gifts.

• Cameras with obstructed views, dirty lenses, or recorded fields of view that no longer match the room.
• Doors that no longer latch fully, or that were propped "for five minutes" and stayed that way.
• Exterior lighting out along a wall, in a parking structure, or near a loading dock.
• Ladders, pallets, or utility boxes left where they can be climbed or stood on.
• Alarm sensors that generate repeated false trips and get acknowledged instead of repaired.
• Key or code holders who have left the organization but whose credentials still work.

Walk the perimeter yourself, at night, on foot, and from the perspective of someone who wants in. Do it monthly. The point of view is the whole exercise.

Procedural Warning Signs Inside the Operation

The quietest red flags live in paperwork. Deposit discrepancies that get adjusted by hand. Vault counts that are "verified" without a second signature. A log book where the same pen, the same handwriting, and the same minute appear across three different people's entries. Sloppy records are how a slow theft stays invisible for months.

If a procedure cannot be broken in a drill, it cannot be trusted in an emergency.

Test the weak links deliberately. Call the after-hours contact and see who answers, and how fast. Trigger a false alarm on purpose and time the response. Ask a teller to describe what they would do if someone handed them a note—and listen for whether the answer includes not opening the vault.

Access review, done properly

1. Reconcile every physical key and every electronic credential to a current employee or vendor.
2. Revoke access the day someone leaves, transfers, or changes roles—not at the end of the pay period.
3. Check who can independently open the vault. If the answer is more than two or three names, fix it.
4. Confirm that time-delay and dual-control settings are active and that override authority is limited and logged.
5. Review the previous month's alarm events and access logs for anything unexplained.

Vendor, Contractor, and Communications Exposure

Your attack surface includes the people you let in and the information you let out. A cleaning crew with after-hours access, a technician who services the vault door, a cash-in-transit schedule posted where the wrong person can read it. Each is a legitimate relationship that also creates a window.

Keep schedules need-to-know. Verify contractors against a call-back number you already have on file, never one they provide at the door. Escort anyone working near the vault. And consider what your public footprint says: social posts about a renovation, a hiring ad that names your alarm vendor, a lobby photo showing the vault wall layout. Small leaks combine.

Turning the Checklist Into a Habit

A checklist is only as useful as its cadence. Put the following on the calendar and assign an owner to each: a monthly physical walk of the perimeter and vault corridor; a quarterly access and key reconciliation; an unannounced dual-control drill; a review of the incident log for unresolved patterns; and an annual refresh of the after-hours contact list. Keep the log somewhere two people can see it, and make it acceptable to report something that turns out to be nothing. Most of what you record will be nothing. That is the point—you are buying information cheaply, before it gets expensive.

When a concern crosses from odd to threatening, go to law enforcement and your corporate security team rather than handling it internally. And where insurance, regulatory, or legal obligations are involved, involve the appropriate professionals early; a documented timeline is worth more than a confident memory.

Photo: RyanMcGuire / Pixabay