First Citizens Bank Teller Sentenced After Stealing $150,000 From Two Seniors

Added: 2026-05-27

[00:00:00]Bam. FBI, step away from the vehicle.

[00:00:02]Hands where I can see them now.

[00:00:03]>> I just got off shift. I was driving.

[00:00:04]>> Sarah Wilson worked as a bank teller for barely 6 months before federal investigators caught up with her. By the time this footage ends, she will have pleaded guilty to stealing $150,000 from two elderly customers [music] she knew by name.

[00:00:21]>> Embezzlement by a bank employee.

[00:00:23]$150,000 from your teller drawer.

[00:00:24]Fraudulent entries against two elderly customers.

[00:00:26]>> The audit had to be wrong. I balanced my drawer. The records told the whole story. Five months of transactions logged under one teller's credentials.

[00:00:36]Every entry timestamped. Every dollar accounted for in the bank's own arithmetic.

[00:00:42]By the time federal auditors finished reconstructing what had happened inside the Pilot Mountain branch of First Citizens Bank, Sarah [music] Wilson was staring at three federal counts of embezzlement, a restitution order for the full 150,450 [music] she had stolen and 21 months in federal prison. Her career as a bank teller had [music] lasted 6 months.

[00:01:10]the investigation that ended it would take less than 10.

[00:01:14]Before we continue, when was the last time you actually looked at your savings [music] account? Not your checking, not your debit card balance, your savings, [music] your certificates of deposit, the accounts you opened years ago and forgot [music] about. Drop a comment and tell me when you last checked. And if you're not subscribed yet, now's the time.

[00:01:39]We hold people who abuse a position of trust accountable every single week.

[00:01:45]Sarah Wilson was born in 1997 in Suriri County, North Carolina in the shadow of Pilot Mountain, the granite knob that rises 1,400 ft above the rolling tobacco country of the western Piedmont and gives the town below it its name.

[00:02:03]The town itself was small, just under 1,400 people. Two stoplights on Main Street, a high school, a Hardies, a Walmart 20 minutes north in Mount Ary, and a First Citizens Bank branch that had occupied the same brick building on Main Street since before she was born.

[00:02:26]Her family was workingass. Her father worked in maintenance at one of the textile facilities that still operated in Sururi County in the early 2000s.

[00:02:36]The kind of plant that had survived two rounds of layoffs and would not survive a third. Her mother worked as a receptionist at a chiropractor's office in Mount Ary.

[00:02:49]The Wilsons rented a singlestory house off Highway 268 with a covered front porch that faced east toward the mountain.

[00:02:59]Sarah grew up looking at that granite knob every morning when she walked out to wait for the school bus. She would later tell investigators it was the first thing she ever counted on staying the same.

[00:03:13]She attended East Suri High School where she was a quiet student. Her teachers described her as polite, prompt, and unmemorable in the way that smalltown teenagers often are. Present, accounted for, never in trouble, never standing out. She made bees. She ran one season of track in 10th grade and did not return for 11th.

[00:03:38]She worked weekends at a food line on Highway 52, scanning groceries and bagging for tips, where she first learned the rhythm of a cash drawer. The slide of the bills under the spring clip, the change counting cadence, the end of shift balance, the specific dread of being a dollar short.

[00:04:00]She graduated in 2015.

[00:04:03]There was no 4-year college plan. She enrolled the following fall at Suriri Community College in Dobson, 15 mi south in their accounting and bookkeeping program.

[00:04:15]It was a practical choice. The program was 18 months. The tuition was low. The job market for bookkeepers in Surrey County was thin but stable. She finished the program in 2017 with a certificate and no debt. Her early 20s were a stretch of small jobs.

[00:04:35]She worked as a part-time bookkeeper for a heating and cooling company in Mount Ary. She worked one summer as a front desk clerk at a hotel off Interstate 77.

[00:04:47]She worked 11 months as an accounts receivable clerk for a regional flooring distributor before the company restructured and eliminated her position. Each job paid a little better than the last. None of them paid enough.

[00:05:02]She moved back in with her parents twice between the ages of 20 and 24.

[00:05:09]She got engaged at 23, married at 24, and was already going by two names.

[00:05:15]Wilson, the name on her driver's license, and Canoi, the name on her marriage certificate. By the time she walked into the First Citizens Bank branch on Main Street for a job interview in November of 2023, she was 26. She had been out of work for 4 months. The teller position paid $16.50 an hour. The benefits were modest but real. Health insurance, a retirement match, two weeks of paid leave.

[00:05:50]The branch manager who interviewed her later told investigators she had been impressed by Sarah's accounting background, her quiet demeanor, and the fact that she already knew most of the regular customers by name from her years growing up in town.

[00:06:06]She was Siri County through and through.

[00:06:08]The manager said she knew everybody.

[00:06:11]Everybody knew her.

[00:06:14]Sarah Wilson started work at the Pilot Mountain branch of First Citizens Bank on December 4th, 2023.

[00:06:22]She completed 3 days of teller training at a regional facility in Winston Salem.

[00:06:27]She was issued a four-digit employee number, a system login, and a key to her cash drawer. She shadowed the branch's senior teller for 2 days. On her sixth day, she opened her drawer alone for the first time.

[00:06:43]Her colleagues described her as polite, careful, soft-spoken.

[00:06:49]She wore the bank's required dress code, black slacks, a tucked white blouse, a thin First citizen's lanyard with her photo ID hanging from it. She kept a small framed photo of her husband on the counter behind her station. She brought her lunch from home in a softsided cooler. She rarely took her full break.

[00:07:12]She balanced her drawer at the end of her first week with no discrepancy, and her supervising teller noted in her 30-day review that she showed strong attention to detail and consistent procedural compliance.

[00:07:26]She was, by every observable measure, exactly the kind of small town hire that First Citizens had built its reputation on for the better part of a century.

[00:07:38]The first fraudulent transaction was logged 23 days after she started. The Pilot Mountain branch of First Citizens Bank was in banking terms small.

[00:07:50]Three teller stations along a low marble counter.

[00:07:54]A single drive-thru lane. Two private offices in the back for the branch manager and the customer service representative.

[00:08:04]a vault the size of a walk-in closet.

[00:08:07]The branch served approximately, 1100 active customers, most of them long-term accounts that had been opened in the 1980s, the ' 70s, the60s.

[00:08:20]Some had been opened by customers who were now dead and were still being managed by their adult children. It was the kind of branch where the average customer relationship measured in decades, not years.

[00:08:34]A teller's daily routine at a branch that size is straightforward and tightly choreographed. At opening, each teller is issued a cash drawer from the vault.

[00:08:46]A specific dollar amount counted twice signed for under that teller's name and employee number. Through the day, every transaction the teller performs, deposits, withdrawals, check cashaching, money orders, vault buys, vault sells, is logged into the bank's transaction system under her four-digit login. The drawer is hers, the login is hers, the trail is hers. At the end of each shift, the teller balances the drawer. She counts the cash. She runs a system report. The two numbers, the physical cash on hand and the systems record of what she should have on hand are supposed to match to the penny. If they do not match, she has a small allowance to correct minor errors. Beyond that allowance, the imbalance is reported to the head teller, then to the branch manager. A persistent imbalance triggers an audit. It is a system designed around the assumption that small discrepancies are rare and large discrepancies are impossible to hide.

[00:09:57]The whole architecture of the trust between a teller and the bank she works for rests on a single premise. That what the teller types into the system matches what she takes from the drawer. The bank trusts her arithmetic. The customer trusts that the arithmetic was honest.

[00:10:15]There was one structural weakness in that system and Sarah Wilson identified it within her first three weeks on the job.

[00:10:24]The bank's auditing was not real time.

[00:10:27]End of shift balances were checked daily by the head teller, but full audits of vault buy and vault sell entries. The bookkeeping that moved cash between the vault and individual drawers were performed monthly, then quarterly, then annually, with the deepest review happening only once a year. If a teller could enter a fraudulent vault transaction into the system to cover a short drawer at the end of the day, the discrepancy would not necessarily be flagged immediately.

[00:10:59]It would sit in the books quietly until the next reconciliation pass.

[00:11:05]The other weakness was human.

[00:11:08]In a town of 1,400 people, the teller and the customer were often neighbors.

[00:11:13]Some customers checked their accounts online every morning. Many did not. The branch had a sizable population of elderly customers, retirees, widows, widowers who had banked at First Citizens for 40 or 50 years and trusted the bank entirely.

[00:11:33]They received paper statements in the mail. They read those statements with a magnifying glass at the kitchen table, if they read them at all.

[00:11:43]They asked questions of the teller they liked, the one they knew, the one whose mother they had seen at the post office or whose father had fixed their washing machine years before. They trusted the person on the other side of the marble counter. And the person on the other side of the marble counter could see in the bank system exactly how much money they had, exactly how often they checked it, and exactly which accounts they were least likely to notice.

[00:12:15]The first theft was small.

[00:12:18]On December the 27th, 2023, 3 days after Christmas, 23 days after she had opened her drawer alone for the first time, Sarah Wilson removed an amount from her cash drawer that the federal indictment would later not specify in dollar terms, but [snorts] which prosecutors described as modest, consistent with a test of the system. At the end of that shift, her drawer balanced. The system showed her drawer balanced, the cash was gone, and the book said otherwise. She had concealed it with a single fraudulent vault sale entry.

[00:12:59]In the system, she had recorded that she had sold cash from her drawer back to the branch vault, a routine end of day transaction performed by tellers whose drawers were holding more than their assigned float. The vault in the system now showed that it had received the cash. The vault in reality had not. But no one would count the vault until the next monthly reconciliation.

[00:13:28]By then she planned to be ahead of it.

[00:13:32]Over the next four weeks, the thefts continued. They were small at first, then larger. Each one was covered the same way. A fraudulent vault cell entry logged under Sarah Wilson's four-digit credentials timestamped to the minute, slotting neatly into the day's transaction record. By the end of January 2024, prosecutors would later calculate she had stolen just under $9,000 from her drawer.

[00:14:04]But the vault cell cover story had a problem. Every fraudulent entry made the vault's books say there was more cash in the vault than there actually was.

[00:14:15]If the monthly vault count happened on schedule, the discrepancy would surface.

[00:14:21]She needed a second layer, a way to make the missing cash appear to have left the bank entirely, not just moved from her drawer to a vault that did not actually have it.

[00:14:34]She found that second layer in the accounts of customers she knew. The first victim was a man in his late 80s.

[00:14:42]He had banked at First Citizens since before the branch had a computer.

[00:14:47]He had a savings account opened in 1963 and a certificate of deposit that he had rolled over every 5 years since 1981. He came into the branch once or twice a month, usually with a small paper deposit, a social security check, a dividend from a brokerage account, a refund from the county. He liked Sarah.

[00:15:13]He had known her father. He called her young lady and Miss Wilson. He never asked to see his account balance. He took the deposit slip back with the new total written on it, folded it twice, and put it in his shirt pocket. Between late January and the end of March, Sarah Wilson logged a series of fraudulent withdrawal entries against the elderly customer's savings account and certificate of deposit.

[00:15:41]The withdrawals were not large individually. $1,500 here, 3,000 there, 5,000 at the high end. None of them generated a notification to the customer because he had never set up online banking and had no email address on file.

[00:16:00]The bank mailed him paper statements once a month. He did not always open them. When he did open them, the print was small and the columns were dense and the math was to him exactly what he expected it to be. because the young woman at the counter, who he liked, had told him it was. By the end of March, the man's combined savings and certificate of deposit had been depleted by $59,700.

[00:16:31]The cash from those withdrawals, cash that had never actually been handed to him, cash that existed only as a line in the bank's transaction system, had been used to balance Sarah Wilson's drawer.

[00:16:45]The vault sale entries had been quietly reversed. The books for the moment balanced.

[00:16:52]In early April, she moved to a second customer. He was 90 years old. He had a certificate of deposit at the branch worth approximately $45,000.

[00:17:05]He came in even less often than the first victim. His statements went to a P.O. box that his daughter checked every few weeks, but the daughter was not a signer on the account and did not have direct online access. By the end of May 2024, Sarah Wilson had drained that certificate of deposit by $42,650 through a series of fraudulent withdrawal entries logged under her own credentials.

[00:17:34]The total across the two elderly customers, across the fraudulent vault entries, across her own teller drawer had reached $150,450 in stolen cash.

[00:17:49]6 months on the job, one drawer, two victims who trusted her, hundreds of fraudulent entries, every one of them logged under the four-digit employee number that had been assigned to her on her first day. She bought no obvious luxuries. She did not buy a new car. She did not move out of the house she rented with her husband off Highway 268.

[00:18:16]Investigators would later find evidence of cash spending, restaurants in Mount Ary and Winston Salem, weekend purchases at the Hannes Mall, an itemized list of consumer goods that did not on its own explain the full $150,000 figure.

[00:18:36]Some of the cash was never recovered.

[00:18:38]Some of it, prosecutors would later acknowledge, simply went into the friction of small daily life. gas, groceries, bar tabs, the slow disappearance of money that has no particular destination.

[00:18:53]What she did not do was stop. In the third week of May 2024, Sarah Wilson's drawer did not balance.

[00:19:03]It was a $38 discrepancy at first. A small thing, the kind of thing that a tired teller writes off to a miscount, a misplaced bill, a customer who paid with hundreds and got hundreds in change.

[00:19:19]She recounted. She reran the report. The number did not change. She entered a small correction and went home.

[00:19:28]The next day, the drawer was over by $14.

[00:19:32]The day after that, it was short by 82.

[00:19:36]The system, which Sarah Wilson had been carefully feeding fraudulent entries for 5 months, was beginning to creek under the weight of its own bookkeeping.

[00:19:47]Her fraudulent vault entries had begun to accumulate in volumes that her endofday balancing could no longer absorb cleanly.

[00:19:56]The fraudulent withdrawals against the two elderly customers had been entered against accounts that the bank's larger reconciliation systems were beginning automatically to flag for review.

[00:20:09]On May 28th, the head teller pulled Sarah Wilson aside and told her there would be a full audit of her drawer the following morning.

[00:20:19]It was a routine statement delivered in a routine tone in the same hallway where the branch's breakroom coffee maker had been broken for a month. Sarah said, "Okay." She finished her shift. She balanced her drawer to the penny by entering that afternoon the largest single fraudulent vault cell entry she had logged to date.

[00:20:43]The next morning, the audit happened.

[00:20:45]The drawer did not balance.

[00:20:48]The system records did not match the physical cache.

[00:20:53]The head teller called the branch manager. The branch manager called the regional security office.

[00:21:00]By the end of that day, May 29th, 2024, Sarah Wilson had been placed on administrative leave pending investigation and her four-digit employee number had been deactivated.

[00:21:14]She drove home that afternoon and did not tell her husband.

[00:21:18]The catalyst was not a tip. It was not a complaint. It was not the 89year-old customer realizing his savings were gone. It was not the 90-year-old customer's daughter opening the P.O.

[00:21:32]box. The catalyst was the bank's own arithmetic. The drawer would not balance. The books would not lie.

[00:21:41]The numbers she had been typing in to hide the theft were the same numbers 6 months later. that proved she had committed it.

[00:21:50]There is a particular moment in cases like this where the person who has been operating in secret realizes that their secret has a physical shape, that it exists as data on a server somewhere, that it has been waiting all along to be read.

[00:22:09]Sarah Wilson did not know on May 29th exactly how much of her work was visible. She did know that the work was visible. She knew that the system she had been editing had not been editing itself.

[00:22:23]She drove home. She made dinner. She told her husband nothing. 3 weeks later, federal agents knocked on the door. The case was referred to the FDIC Office of Inspector General, the federal watchdog that investigates fraud inside FDIC insured banks. In the first week of June 2024, within 10 days, an FDIC special agent had been assigned, working in coordination with the US Attorney's Office for the Middle District of North Carolina.

[00:22:58]The lead prosecutor was assistant United States Attorney Laura Xeen Dildin, [snorts] an experienced financial crimes prosecutor based at the federal courthouse in Greensboro.

[00:23:11]The case was in the most literal sense a paper case.

[00:23:16]There was no surveillance footage to compile. There was no informant to debrief. There were no wire taps, no controlled buys, no undercover agents.

[00:23:27]The entire evidentiary record had been generated voluntarily by Sarah Wilson herself.

[00:23:34]Investigators worked backward through the bank's transaction logs. Every entry was timestamped. Every entry was logged under a fourdigit teller credential.

[00:23:44]Every entry tied to a workstation in the Pilot Mountain branch.

[00:23:49]They identified the first fraudulent vault cell entry. December 27th, 2023, logged at 4:11 in the afternoon, 6 minutes before close.

[00:24:02]They identified the last May 28th, 2024, logged at 5:03 in the afternoon, 3 minutes after the audit announcement.

[00:24:12]In between, they cataloged more than 300 fraudulent entries. Some were vault sales, some were vault buys. Many were withdrawal entries against the two elderly customers accounts.

[00:24:27]Each one was tagged with Sarah Wilson's employee number. Each one was tagged with the workstation identifier of the middle teller window at the Pilot Mountain branch. Each one corresponded to a specific shift she had worked.

[00:24:42]Investigators also interviewed both elderly customers. The 89year-old man was interviewed at his home by an FDIC agent and a senior fraud examiner from First Citizens. He listened. He looked at the paperwork the agents had brought.

[00:25:00]He said slowly that he did not understand. He said he had never taken any of that money out. The agent explained that they knew he had not. The agent explained carefully what had been done to his account. The man told the agent about a conversation. He said that some weeks earlier he could not give an exact date. He had come into the branch with a question. The most recent statement had a number on it that did not look right. He had not been sure. He had asked Sarah Wilson, the young woman behind the counter, whether his account was okay. She had told him the account looked fine. That single sentence, the account looked fine, delivered face to face by a teller who had at that point already drained nearly $60,000 out of the very account she was being asked about, would [snorts] later become the most cited moment in the prosecution sentencing memorandum.

[00:26:00]The fraud was a matter of arithmetic.

[00:26:03]The lie was a matter of character.

[00:26:06]We're heading into the federal courthouse now. If you want to see exactly how this case landed in front of a judge and what 21 months of federal time actually looks like for a six-month spree against two 90year-old neighbors, subscribe and stay with me. We break down every detail. Federal agents arrived at Sarah Wilson's home off Highway 268 in mid June 2024 in the late afternoon after she had returned from a part-time job. She had taken bagging groceries at the Food Lion on Highway 52, the same store where she had worked in high school. She was wearing the Food Lion uniform when she opened the door.

[00:26:51]Two agents identified themselves. They showed their credentials.

[00:26:56]They told her plainly that they were there to ask her about her work at the Pilot Mountain branch of First Citizens Bank between December of 2023 and May of 2024.

[00:27:09]They asked if she would speak with them.

[00:27:12]She said yes. They sat down at her kitchen table. Her husband was not home.

[00:27:18]The conversation was recorded.

[00:27:21]Miss Wilson, the lead agent, began. Do you know why we're here? There was a long pause. I think I do, she said. The agent slid a print out across the table.

[00:27:34]It was a single page. It contained a list of 15 of the largest fraudulent withdrawal entries from the 89year-old customer's account.

[00:27:44]Each one was tagged with her fourdigit employee number. Each one was tagged with the date and time. Each one was tagged with the workstation at the middle teller window. "Can you tell us about these transactions?" the agent asked. She looked at the page. She did not pick it up. "I don't know what to say," she said. "Did you enter these transactions?" "I want to talk to a lawyer." That was the end of the interview. The agents thanked her, collected their materials, and left.

[00:28:20]She closed the door behind them. She walked to the kitchen counter, sat down on a stool, and waited. Her husband came home an hour and a half later. She told him that night what she had done. The federal investigation continued through the rest of 2024 and into 2025.

[00:28:41]The FDIC, OIG, and the US Attorney's Office worked the transaction logs, interviewed bank employees, conducted financial analysis of Wilson's accounts, and assembled the case.

[00:28:56]A grand jury was convened in the spring of 2025.

[00:29:00]The indictment came down in early summer. The charges were three counts of embezzlement by a bank employee under title 18, United States Code, Section 656, the federal statute that criminalizes theft by a person who works for an FDIC insured institution.

[00:29:21]She pleaded guilty on August 4th, 2025.

[00:29:26]Sarah Wilson appeared for sentencing on the morning of January 5th, 2026 in federal court in Greensboro, North Carolina before United States District Judge William L. Austinine Jr., a senior judge with more than two decades on the federal bench and a reputation in the middle district for measured but unflinching sentencing in white collar cases.

[00:29:54]The courtroom was small. The 89year-old customer did not attend. His written victim impact statement was read into the record by an assistant from the US attorney's office. He wrote that he had been a customer of First Citizens Bank for 63 years. He wrote that he had trusted the branch the way he had trusted his own family. He wrote that the bank had made him whole, that the institution had refunded the stolen money with interest within weeks of the fraud being discovered. He wrote that he was grateful for that. He wrote that he did not, however, know what to do with the fact that the young woman who had stolen from him was a person whose father he had known, whose town he had lived in for 90 years, and who had looked him in the face and told him his account was fine.

[00:30:46]I am 89 years old, the statement read. I have been lied to before. I have not until this past year been lied to about the money I worked my whole life to save. I do not understand how a person does this. I do not need to understand.

[00:31:06]I only ask that the court understand.

[00:31:10]The 90-year-old customer's statement was shorter. It was four sentences. It ended. She knew me. I trusted her. I would like the court to remember that.

[00:31:22]Assistant US Attorney Laura Jean Dill Dean prosecuting on behalf of the United States addressed the court for approximately 15 minutes.

[00:31:33]She walked the judge through the timeline. The December 2023 start date, the first fraudulent vault entry 23 days later, the systematic targeting of the two elderly customers, the lie at the teller window, the audit that finally exposed the scheme.

[00:31:54]She emphasized that this was not a case of opportunity. It was not a single weak moment. It was a pattern of conduct that had begun in the first month of employment and continued for 5 months without any evidence of remorse, any attempt to slow down, any moment of selfarrest.

[00:32:15]The fraud, she told the court, was not an aberration in Sarah Wilson's career.

[00:32:21]It was Sarah Wilson's career. The defense argued for leniency.

[00:32:27]Wilson's attorney pointed to her cooperation after the initial interview, her clean criminal history, her acceptance of responsibility through an early guilty plea, her status as a firsttime offender, and the fact that the financial institution had been made whole.

[00:32:46]He asked the court to impose a sentence at the low end of the federal guideline range with significant supervised release in lie of additional incarceration.

[00:32:57]Sarah Wilson herself addressed the court briefly. She stood at the defense table in a dark dress and a thin cardigan.

[00:33:07]She said she was sorry. She said she did not have a good explanation for what she had done. She said she thought about the two customers every day. She said she would spend the rest of her life trying to be the kind of person who would never have done it in the first place.

[00:33:26]She sat down. Judge Ostein took 12 minutes. He addressed Wilson directly.

[00:33:33]He said that the court had read the victim impact statements, the presentance report, the sentencing memoranda from both parties, and the bank's internal investigation summary.

[00:33:45]He said the court had weighed her age, her clean record, her cooperation, and her plea. He said the court had also weighed something else. The position of a bank teller, he said, is a position of public trust. That is not a poetic statement. It is a statement of the operational reality of consumer banking in this country. The customer hands the teller money. The customer trusts that what the teller enters into the system matches what the teller takes.

[00:34:16]That trust is the entire foundation on which deposit banking operates.

[00:34:22]When a teller violates that trust, particularly when she does so, as you did, against elderly customers who knew her by name and trusted her precisely because of that familiarity.

[00:34:35]She does not merely steal from the bank.

[00:34:39]She steals from every customer who will going forward walk into a branch and wonder even for a moment whether the young person on the other side of the counter is telling them the truth about their own money. That harm is not measured in dollars. It does not appear on the restitution order, but it is real and this court must account for it. He paused. He looked down at the bench.

[00:35:09]21 months in the custody of the Bureau of Prisons, he said, followed by 3 years of supervised release.

[00:35:17]Restitution in the amount of $150,450 payable as directed by the probation office.

[00:35:27]Self-surrender within 60 days. Sarah Wilson was designated to a low security federal facility for women. Her projected release date is in the late autumn of 2027.

[00:35:41]She will be 29 when she walks out. She will owe $150,450 in restitution.

[00:35:50]She will be ineligible for the rest of her life to work in any FDIC insured banking position.

[00:35:58]The Pilot Mountain branch of First Citizens Bank remains open. The marble counter is still there. The middle teller window is still in use. The 89year-old customer and the 90-year-old customer were both reimbursed in full by the bank within weeks of the audit. One of them still banks at First Citizens.

[00:36:18]The other moved his accounts to a different institution. He did not explain why that case was small in dollars and devastating in trust.

[00:36:28]But the next case on your screen right now is something else entirely.

[00:36:33]A betrayal at a scale that will leave you speechless.