On 28 October, the day the scam was discovered, the guilty parties allegedly set about covering their digital tracks by creating "malicious unauthorised" user accounts with privileged access to Postbank's systems. These were used to erase audit trails until discovered and disabled by Postbank on 4 November, according to Ankura.