Trusted, trained and sometimes a threat: The risk within India's banks

Behind the forensics and policy responses lies a question that India's banking industry is asking itself today: How to deal with insider bank frauds

The fraudster doesn’t wear a mask or hack in from outside. The fraudster has the key to enter the system (the login password), a designation, and years of institutional trust.

 

The core banking solution (CBS) has digitised every branch. It has also handed the insider an invisible weapon to attack – to debit accounts, backdate entries, park funds in suspense accounts (a temporary holding place used to record incoming or outgoing funds that cannot be immediately matched), activate dormant accounts of customers and move money to relatives or mule accounts.

 

The fraudster takes advantage of late generation of activity reports and the lack of staff strength to scrutinise entries immediately after the generation of such reports. It’s not easy to go through the labyrinth of data, manually analyse and detect the loss.

 

Indeed, banks are well aware of this phenomenon. The fraud cases involving bank staff have fallen from 2,624 in FY21 to 1,935 in FY25, and 400 in the first half of FY26. Staff fraud is only 8 per cent of total cases but likely much higher in value. The decline in numbers suggests that existing controls (maker-checker – where two people are needed to complete a task – job rotation, whistleblower schemes) are working. But more needs to be done.

 

CBS eliminates manual errors and enables real-time, branch-agnostic processing. It has succeeded on both counts. But the same architecture that lets a customer transact from any branch also lets a bank employee who has access to the system debit multiple accounts, credit funds to an account in a different bank, and route the proceeds to mule accounts or accounts of relatives. Once that is done, recovery becomes difficult.

 

The most technically dangerous method exploits “value dating” -- the principle that interest accrues from the date of credit entry and not the actual transaction date. A staff member can post a backdated credit, square off the entry on the date of creation, let the system calculate and credit interest for the intervening period, then reverse the principal while leaving the already-credited interest untouched.

 

Since each debit is matched by a same-day credit reversal, it may escape routine exception reports; losses accumulate silently over years.

 

Inter-branch office and suspense accounts can also be abused. Funds can be fraudulently parked in such accounts and squared off before the end-of-day cycle closes. System logs capture every user ID involved in both schemes but exception reports, typically, are only reviewed during periodic inspections, not continuously. This gives the insider a wide window of opportunity.

 

The banks need to shift from annual audits to a "data + behaviour + controls" framework that triggers in real time as staff fraud is hard to catch – the perpetrator already knows what the audit will detect and what it won't. Automated red-flag rules on the CBS/AML (anti-money laundering) layer should fire instantly instead of waiting for the periodic review.

 

The focus could be on the following activities:

• Employee access to accounts of relatives, dormant and VIPs without a mapped business reason;
• After-hours logins (9 PM–6 AM), weekend or holiday system access;
• Repeated overrides of transaction limits, KYC checks, interest rates or fee waivers;
• Round-tripping, when the same employee both debits and credits across multiple accounts;
• Structuring or splitting large transactions to stay under approval thresholds; and
• Fund transfer following the addition of a beneficiary or any other change in an account.

These apart, biometric login into the system should be non-negotiable. Single biometric identity should not be allowed to play the role of maker and checker of the same transaction. This will prevent the fraudster from stealing and misusing other staff's passwords.

 

Finally, no ID should be allowed to remain active for more than a specified time, say 15 minutes, if not used. This will minimise the risk of login password-sharing by higher authorities, who often share with their trusted staff the most vulnerable treasure. All banks must make use of user and entity behaviour analytics (UEBA) to baseline normal activity per employee and flag deviations in near-real time. Behavioural signals are important.

 

What are abnormal activities?

 

• Lifestyle and income mismatch. Buying a high-end car, too many overseas holidays beyond means and personal loan defaults;
• When an employee does not take leave for years, resists transfers and works late every day; and
• Missing documentation, frequent visits to high-value accounts without any reason, scanning for dormant accounts with requests from related customers.

Structural controls that can ensure early detection of fraud include adoption of the so-called four-eye principle. It’s a governance- and risk-management tool which requires at least two distinct, authorised people to review and approve a critical action, decision, or transaction before it takes effect. No single employee can open an account, disburse a loan, or execute an RTGS transfer by himself or herself.

 

Other such controls include mandatory job rotation; surprise audits and cash verification; daily automated reconciliation of teller cash, suspense, and general-ledger accounts; and anonymous whistleblower hotlines. Industry estimates that about 40 per cent of staff frauds come to light through the last route.

 

Senior citizens typically have a single trusted point of contact at a bank branch. Banks should encourage such customers to interact with multiple staff members and any loan sanctioned against a term deposit receipt belonging to a senior citizen should automatically alert a higher-level officer for independent cross-verification.

 

Deceased-account handling needs the same systemic rigour. As civil registration and KYC databases become better integrated, banks should move towards systems that promptly freeze accounts after verified notification of death. AI-enabled, Aadhaar-linked payment verification can intercept unauthorised withdrawal attempts on unclaimed deposits before funds move.

 

NRI accounts warrant an additional safety layer, given the physical distance between the customer and the branch. Any loan or lien against an NRI account should require scanned-document verification through large language model-based document authentication tools before approval. 

 

Vigilance departments in Indian banks have limited deployment of AI or machine learning models for preventive vigilance. Most vigilance activity remains reactive – triggered after a complaint or loss rather than by predictive pattern detection.

 

Industry-wide data on staff-perpetrated fraud, if pooled and modelled, could allow AI systems to learn behavioural baselines for different staff roles, detect deviations over time, and alert administrative and vigilance offices before a loss crystallises rather than after. This is an open frontier for fintech vendors.

 

Cybersecurity tooling till now has overwhelmingly targeted external, customer-facing fraud, leaving staff behaviour monitoring comparatively underbuilt despite its significant share in the value of frauds.

 

High attrition and frequent staff movement in private banks mean institutional memory about individual behaviour patterns resets constantly. Newly hired, tech-savvy employees understand the system architecture and its blind spots pretty well.

 

Robust systems ultimately rest on three commitments: A visible, monthly-communicated zero-tolerance tone from the senior leadership; hard data segregation which doesn’t allow any employee to access accounts belonging to themselves or their immediate family within the CBS; and a mandatory post-incident review after every fraud that updates detection rules to prevent recurrence of similar frauds.

 

The Reserve Bank of India’s directives asking banks to minimise system-generated internal accounts, a favoured parking spot for fraudulent loan proceeds and broken term deposits reflect the same underlying philosophy -- shift responsibility from human vigilance to a systemic design. When a bank runs millions of daily transactions, a human reviewer will always arrive too late.

 

Behind the forensics and the policy responses lies a question that India's banking industry is asking itself today: Does working daily with other people's money, in an environment of constrained salaries, rising lifestyle aspirations, and algorithmically addictive betting platforms gradually erode the ethical boundaries for certain bankers?  This is the final part of a series on bank frauds committed by insiders. The first two parts appeared on July 20 and 27 

---

The writer is an author and senior advisor to Jana Small Finance Bank Ltd. His latest book: Roller Coaster: An Affair with Banking. To read his previous columns, log on to www.bankerstrust.in. X: @TamalBandyo