A computer-implemented method of fraud detection within a contact center, the method performed by a system of computer-based workstations (100, 230, 260, 300), each workstation including a processor (110, 120) configured for: monitoring activity of a plurality of agents attending to a plurality of workstations of a contact center; determining that a first agent at a first workstation of said contact center is not on a call at a first time; determining that said first agent is accessing a client based resource at said first time, wherein said client based resource is associated with and managed by a client at a back end server remote from said contact center, wherein said client based resource is accessed by an electronic resource at said first workstation through a communication network (250, 280); collecting electronic evidence of said first workstation, wherein said electronic evidence is associated with potential fraudulent activity being conducted at said first workstation, wherein said potential fraudulent activity comprises unauthorized access by said first agent to said client based resource and occurs when: i) a first condition is satisfied when said first agent is not on said call at said first time and ii) a second condition is satisfied when said first agent is accessing said client based resource at said first time; wherein said collecting electronic evidence comprises: determining identifying information for a scheduled agent assigned to said first workstation; capturing an image of a positioned agent located at said first workstation; cross-referencing said image of said positioned agent with said identifying information; and authenticating that said positioned agent is not said scheduled agent. monitoring activity of a plurality of agents attending to a plurality of workstations of a contact center; determining that a first agent at a first workstation of said contact center is not on a call at a first time; determining that said first agent is accessing a client based resource at said first time, wherein said client based resource is associated with and managed by a client at a back end server remote from said contact center, wherein said client based resource is accessed by an electronic resource at said first workstation through a communication network (250, 280); collecting electronic evidence of said first workstation, wherein said electronic evidence is associated with potential fraudulent activity being conducted at said first workstation, wherein said potential fraudulent activity comprises unauthorized access by said first agent to said client based resource and occurs when: i) a first condition is satisfied when said first agent is not on said call at said first time and ii) a second condition is satisfied when said first agent is accessing said client based resource at said first time; wherein said collecting electronic evidence comprises: determining identifying information for a scheduled agent assigned to said first workstation; capturing an image of a positioned agent located at said first workstation; cross-referencing said image of said positioned agent with said identifying information; and authenticating that said positioned agent is not said scheduled agent. determining identifying information for a scheduled agent assigned to said first workstation; capturing an image of a positioned agent located at said first workstation; cross-referencing said image of said positioned agent with said identifying information; and authenticating that said positioned agent is not said scheduled agent.