A method of fraud detection is disclosed. The method includes determining that a first agent at a first workstation of a contact center is not on a call at a first time. The contact center includes a plurality of workstations attended to by a plurality of agents. The method includes determining that the first agent is accessing a client based resource at the first time, wherein the resource is associated with a client. The method includes collecting electronic evidence of the first workstation.