Lapping it up: a skimming method doomed to failure over time.

Nelson, a computer programmer for a financial institution in New Orleans, sat across the desk from his boss. Nelson flinched when the boss told him the news that he, an 11-year company veteran, was in trouble with the home office in Dallas because of irresponsible behavior.

More than a year ago, Nelson had accepted a promotion requiring a transfer to New Orleans from Dallas. The company extended him a $15,000 bridge loan, temporary funds to cover moving and household expenses. Nelson never paid back the loan, however, even after repeated requests to do so.

Unbeknownst to the company, Nelson had been in serious hock for years. He and his wife just couldn't seem to control their spending. With creditors hounding him, Nelson had taken the $15,000 and paid some of his most pressing debts. Now, with the boss facing him, he didn't know what excuse to use this time for not paying back the company.

But the boss was beyond being mollified with any more excuses. "Nelson," he said, "the company has made it pretty clear: If you don't get this debt taken care of, it's going to cost you your job. Do you understand?" Nelson understood.

Necessity being the mother of invention, Nelson concocted a plan made possible only by an internal control deficiency at the company big enough to drive a truck through: unrestricted access to "live" data (read: customer accounts). Even as the …