Catch the scam if you can: Rising frauds expose growing governance gaps

Despite tech investment, rising complexity in frauds exposes governance gaps and digital vulnerabilities. There is an urgent need for stronger oversight

Bank of Baroda (BoB) paid $600 million to settle an international fraud case that lasted over a decade. Its Q1FY27 net profit was lower at  ₹1,278 due to this exceptional item; otherwise, it would have been ₹5,528 crore. 

“It is a commercially-prudent decision, taken without any admission of liability or wrongdoings,” said BoB’s managing director (MD) and chief executive officer (CEO) Debadatta Chand while announcing its results on Friday. 

Reserve Bank of India (RBI) data has it that the number of frauds stood at 18,386 with the sum involved at ₹16,569 crore in FY25; in HIFY26 (source: Report on Trend and Progress of Banking in India for FY25) while the number of frauds fell to 5,092, the amounts involved rose to ₹21,515 crore. 

Looked at in another way, the ticket-size of fraud (per account) is getting bigger. RBI’s footnote says that frauds reported in a year could have occurred several years before the year of reporting; the amounts involved are as reported and do not reflect the loss incurred. 

A paper by RBI staffers — in its February 2022 bulletin — noted that zombie firms account for about 10 per cent of the total debt in the non-financial corporate sector; they also absorbed about 10 per cent of the bank credit extended. 

Why are we where we are on frauds despite all the investments in technology? “This persistence (of zombie firms) is not a failure of technology as much as it is a challenge of incentives, governance, and fragmented decision-making,” says Jaya Vaidyanathan, founder of Capetal Labs (a risk management, compliance, fraud prevention, cybersecurity, financial crime, governance, and AI-solutions firm) who also serves on the global board of PwC. 

Moreover, conventional credit assessment models remain largely backward-looking, relying on historical financial statements and repayment behaviour. “They are less effective in identifying structural business decline caused by technological disruption, changing market dynamics, or weakening competitive positions.” 

Digital complicates the plot with its facelessness. TransUnion — a global information and insights company — in its report on Top Fraud Trends for HI 2026 (calendar year) said worldwide, account creation remains the highest-risk stage across the digital consumer lifecycle, with 8.3 per cent of those transaction attempts suspected to be fraudulent in 2025. 

In India, however, fraud risk was most concentrated at account login (3.9 per cent) last year, reflecting growing attempts to compromise legitimate user credentials, followed by account creation (3.1 per cent) and financial transactions (1.2 per cent).

“This underscores how fraudsters are targeting digital identities, making trust and authentication critical in the fight against fraud,” says Natarajan Ramani, head — TransUnion India Data Analytics Solutions, the Indian arm of TransUnion. “…  customers are increasingly exposed to scams that closely mimic trusted brands and institutions, making fraudulent interactions harder to distinguish from legitimate ones.” 

In April this year, Hyderabad police blew the lid off a cyber-fraud under Operation Octopus 2.0 and arrested 52 suspects, including 32 bank employees spread over nine states. How are low-skilled actors able to carry out high-impact frauds?

“It’s not about individuals operating the mule accounts being more or less skilled. Instead, ‘lower-level’ refers to the role the individual account plays in the broader mule network,” said Subhashish Bose, director-global advisory at BioCatch, a New York-headquartered behavioral biometrics firm. “Each mule only has visibility into its individual account and the transfers it receives and sends. The person running the account doesn’t need technical expertise or deep knowledge of the fraud scheme.” 

“Access is what defines modern cyberattacks — sophistication is no longer a prerequisite,” says Rajesh Chhabra, general manager — Asia Pacific (APAC) for Acronis, a global cyber protection enterprise. Fraud is increasingly less about exploiting technology and more about exploiting human trust. “The question isn’t how skilled the attacker is. It’s whether they have access to sophisticated tools; increasingly, they do. That is why organisations need to view fraud not simply as a financial crime problem, but as a cyber resilience challenge.” 

With the intersection between banks and non-banking financial companies (NBFCs) increasing — outsourced services and co-lending — another blind spot, needs attention. NBFCs have sought access to Mint Road’s central fraud registry (CFR) which came into being in 2016. It is a database of bank frauds over ₹1 lakh, but as of today, only banks can hook into the registry. The matter has been taken up by NBFCs with the Department of Financial Services (DFS) even as it may need an amendment to the RBI Act, 1934. 

It is also surmised that the demand by NBFCs for access to the CFR may now renew a similar demand for the Central Repository of Information on Large Credits (CRILC). 

Set up in FY15, CRILC is a database for offsite supervision of banks. It captures the credit information of large borrowers defined as those having an aggregate fund-based and non-fund-based exposure of ₹5 crore and above. What is interesting here is that while NBFCs must report relevant credit information quarterly to CRILC, they lack access to the data of their own or prospective customers (through CRILC). Incidentally, in the past, mutual funds have also demanded access to CRILC. 

At a meeting of bank corner-room occupants on July 14, RBI governor Sanjay Malhotra stressed robust cybersecurity, strong internal controls and safeguards against fraud and data misuse. 

How serious Mint Road views these issues was evident when it released its Guidance on Regulatory Expectations for Data Governance the very next day for feedback. 

The objective: As the volume, variety and velocity of data continues to increase, effective data governance has become essential to ensure that data remains accurate, consistent, secure and fit for purpose across functions and systems. “Weaknesses in data governance and management can lead to broader financial, operational, compliance and reputational risk for regulated entities,” RBI said. 

So, where are we now? A quote attributed to Sophocles is “Rather fail with honour than succeed by fraud,” but he was just a Greek poet; and the times have changed.